Malicious Chrome, Edge extensions manipulating Google search results
According to Avast, these extensions affected 3 million users worldwide.
Google’s Chrome browser is the most used web browser in the world while Microsoft’s Edge browser is the least used one. Yet, it comes pre-installed on all Windows devices. As of 2020 1.2 billion Windows PCs in use worldwide meaning both browsers are lucrative targets for cybercriminals and the latest report from IT and software security firm Avast proves it.
The IT security researchers at Avast have discovered a vast network of malicious Chrome and Edge browser extensions, which are hijacking clicks to links in search results to display arbitrary URLs such as phishing websites and malicious ads.
Over a Dozen Chrome Extensions Caught Hijacking Google Search Results for Millions
New details have emerged about a vast network of rogue extensions for Chrome and Edge browsers that were found to hijack clicks to links in search results pages to arbitrary URLs, including phishing sites and ads.
Collectively called CacheFlow by Avast, the 28 extensions in question including Video Downloader for Facebook, Vimeo Video Downloader, Instagram Story Downloader, VK Unblock made use of a sneaky trick to mask its true purpose: Leverage Cache-Control HTTP header as a covert channel to retrieve commands from an attacker-controlled server.
All the backdoored browser add-ons have been taken down by Google and Microsoft as of December 18, 2020, to prevent more users from downloading them from the official stores.