The users of the extensions are unaware of this functionality and the privacy risk of every site being visited being sent to the servers of the extension authors.įull Page Screenshot Capture – Screenshotting

This action modifies the cookies on the site so that the extension authors receive affiliate payment for any items purchased. They do this so that they can insert code into eCommerce websites being visited. Every website visited is sent to servers owned by the extension creator. T he la t ter borrows several phrases from another popular extension called GoFullPageĪpart from offering the intended functionality, the extensions also track the user’s browsing activity.

The extensions offer various function s such as enabling users to watch Netflix shows together, website coupons, and taking screenshots of a website. Since that time, we have investigated several other malicious extensions and discovered 5 extensions with a total install base of over 1,400,000 SeptemUpdate : Since the original publication of this blog on August 29, 2022, the AutoBuy browser extension was updated in the Chrome Store on Septemwith a version that no longer contains the potentially harmful features originally discussed in this blog.Ī few months ago, we blogged about malicious extensions redirecting users to phishing sites and inserting affiliate IDs into cookies of eCommerce sites. SeptemUpdate : Since the original publication of this blog on August 29, 2022, the Flipshope browser extension was updated in the Chrome Store on Septemwith a version that no longer contains the potentially harmful features originally discussed in this blog. Authored by Oliver Devane and Vallabh Chole

Google chrome store