Danger Alert: 100+ Fake Chrome Extensions Stealing Data and Hijacking Sessions in 2025

Dangerous Deception: Over 100 Fake Chrome Extensions Discovered Stealing Data and Hijacking Sessions

In a concerning development for internet users worldwide, cybersecurity researchers have uncovered a massive campaign involving over 100 Fake Chrome Extensions designed to steal sensitive information and hijack browser sessions. This sophisticated operation, active since February 2024, represents one of the most extensive browser extension-based threats in recent years, potentially affecting millions of users who unwittingly installed what appeared to be legitimate tools.

The Growing Threat of Fake Chrome Extensions

Browser extensions have become an integral part of our online experience, offering enhanced functionality and convenience. However, this recent discovery by DomainTools Intelligence (DTI) researchers reveals how cybercriminals are exploiting users’ trust in the Chrome Web Store to distribute malware at an unprecedented scale.

The threat actor behind this campaign has created a network of fake websites masquerading as legitimate services, including AI tools, VPN providers, productivity enhancers, and financial applications. These deceptive sites then direct unsuspecting visitors to install corresponding Fake Chrome Extensions from Google’s Chrome Web Store.

“The actor creates websites that masquerade as legitimate services, productivity tools, ad and media creation or analysis assistants, VPN services, crypto, banking and more to direct users to install corresponding Fake Chrome Extensions on Google’s Chrome Web Store,” according to the DomainTools Intelligence team’s report.

How These Fake Chrome Extensions Work

What makes these Fake Chrome Extensions particularly dangerous is their dual functionality. On the surface, they appear to provide the advertised features, giving users no reason to suspect anything amiss. However, beneath this benign facade lies sophisticated malware designed to:

• Steal credentials and browser cookies: Potentially compromising accounts across multiple services
• Hijack active sessions: Allowing attackers to take control of logged-in accounts
• Inject unauthorized advertisements: Generating fraudulent revenue
• Perform malicious redirects: Sending users to phishing sites or other dangerous destinations
• Manipulate web traffic: Potentially intercepting sensitive data
• Execute phishing attacks: Through DOM (Document Object Model) manipulation

The extensions exploit excessive permissions granted during installation through their manifest.json files. These permissions allow them to interact with every website visited by the user, execute arbitrary code from attacker-controlled domains, and modify web content without additional user consent.

Deceptive Tactics Used by Attackers

The sophistication of this campaign extends beyond the malware itself to include several deceptive tactics:

Impersonation of Legitimate Services

The researchers identified several lure websites designed to impersonate trusted services, including:

• DeepSeek (AI assistant)
• Manus (AI tool)
• DeBank (Financial service)
• FortiVPN (Virtual Private Network)
• Site Stats (Analytics tool)

These fake sites are professionally designed to appear legitimate, often mimicking the branding and user interface of the services they impersonate.

Advanced Technical Evasion

The Fake Chrome Extensions employ technical tricks to evade detection, including:

• Using the “onreset” event handler on temporary DOM elements to execute malicious code, likely attempting to bypass content security policies
• Setting up WebSocket connections to act as network proxies for routing traffic through attacker-controlled servers
• Fetching arbitrary scripts from remote servers to update functionality without requiring new extension versions

Review Manipulation

Perhaps most concerning is evidence that the attackers are manipulating extension ratings to maintain high scores in the Chrome Web Store. DomainTools researchers discovered that some extensions, like those impersonating DeepSeek, redirected users providing low ratings (1-3 stars) to a private feedback form, while sending users with positive ratings (4-5 stars) to the official Chrome Web Store review page.

Impact on Users and Businesses

The potential impact of this campaign is substantial, affecting both individual users and organizations:

For Individual Users:

• Theft of sensitive credentials, potentially leading to identity theft
• Unauthorized access to financial accounts
• Privacy violations through the monitoring of browsing activity
• Exposure to additional malware through malicious redirects
• Unwanted advertisements and potential financial losses from click fraud

For Businesses:

• Compromise of employee credentials potentially leading to data breaches
• Session hijacking that could bypass multi-factor authentication
• Network infiltration through compromised browsers
• Reputational damage from services being impersonated
• Increased IT security workload to detect and mitigate threats

How to Protect Yourself from Fake Chrome Extensions

In light of this threat, users should take several precautions when installing and managing browser extensions:

1. Verify Developer Reputation

Before installing any extension, research the developer. Stick with verified developers who have established reputation and multiple published extensions with consistent positive reviews.

2. Review Requested Permissions

Carefully examine what permissions an extension requests. Be wary of extensions requiring access to all websites or the ability to read and modify site data, especially if the extension’s functionality doesn’t seem to require such broad access.

3. Scrutinize Reviews Critically

Don’t rely solely on star ratings. Read both positive and negative reviews, looking for patterns that might indicate artificial manipulation. Be suspicious of extensions with overwhelmingly positive reviews but few details.

4. Avoid Lookalike Extensions

Be cautious of extensions that mimic popular services but come from different developers. Verify that you’re installing the official extension from the legitimate service provider.

5. Regularly Audit Installed Extensions

Periodically review all installed extensions, removing those you no longer use or don’t recognize. Check for unusual behavior like excessive resource usage or unexpected changes to your browsing experience.

6. Keep Your Browser Updated

Ensure your browser is always updated to the latest version to benefit from security patches and improved extension vetting.

Google’s Response and Ongoing Challenges

According to reports, Google has taken down the identified Fake Chrome Extensions from the Chrome Web Store. However, the removal from the store does not automatically uninstall extensions from users’ browsers, leaving many potentially still at risk.

This incident highlights ongoing challenges in securing browser extension ecosystems:

• The inherent tension between functionality and security in extension permissions
• Limitations in automated vetting processes for extension submissions
• The time lag between Fake Chrome Extensions extension discovery and removal
• The persistent nature of extension-based threats even after store removal

Google is working to address these challenges with its transition to Manifest Version 3 (MV3) for Chrome extensions, which aims to enhance security by restricting remotely hosted code and implementing other safety measures. However, the sophistication of this campaign demonstrates that attackers continue to find ways to circumvent existing protections.

The Future of Browser Extension Security

As we move forward, both users and platform providers must adapt to evolving extension-based threats:

• Browser developers need to implement more robust vetting procedures and runtime monitoring of extension behavior
• Extension developers should adopt least-privilege approaches, requesting only the permissions absolutely necessary for functionality
• Users must become more security-conscious when installing and managing extensions
• Organizations should consider implementing browser extension management policies to reduce risk

The discovery of this massive campaign serves as a stark reminder that even seemingly helpful browser tools can harbor significant security risks. By staying vigilant and following security best practices, users can continue to enjoy the benefits of browser extensions while minimizing their exposure to these increasingly sophisticated threats.