Browser extensions provide fertile ground for attackers to access resources on client computers, often with the same permissions as the browser itself. Browsers: Today’s Security FrontierĮveryone uses browsers, and it’s this popularity that makes them particularly enticing targets for adversaries.

Putting into place the security measures to detect the C&C server communications of a malicious Chrome extension, or any malware for that matter, will fill this gap. As such, enterprises cannot assume updated defenses will protect them. Attackers can employ a wide range of techniques to avoid detection by EPPs and TI. The fact these malicious extensions and domains went undetected underscores the limitations of legacy protection systems.

None of the extensions or the domains had been reported as malicious by endpoint protection systems (EPPs) or threat intelligence (TI). Some extensions simply introduced adware, but others stole user credentials and may allow attackers to exfiltrate data or manipulate search results to lure users into downloading malware. Network data from hundreds of Cato customers suggests malware communication persists despite the use of legacy security controls, services, and detection methodsĬato Research Labs released new findings today identifying 24 malicious Chrome extensions and 40 malicious domains, all previously thought to be benign.

Chrome installing addons by itself