Google has recently removed 106 extensions from the Chrome Web Store after it was discovered that they were illegally collecting sensitive user data as part of a “massive global surveillance campaign”. The main targets were oil and gas, finance, and healthcare sectors.

The findings were disclosed by Awake Security, and they said that the malicious browser add-ons were tied back to a single internet domain registrar, GalComm.

However, it’s not immediately clear who is behind the spyware effort.

According to Awake security, the extensions which were part of this campaign involved operations such as loading malware, taking screenshots of victim device, reading clipboard and also actively harvesting tokens and user inputs.

The extensions posed as utilities had capabilities to convert files from one format to the other, among other tools for secure browsing, while relying on thousands of fake reviews to trick unsuspecting users into installing them.

Furthermore, the actors behind the operation also implemented evasion techniques to avoid flagging the domains as malicious by anti-malware solutions, which thereby allowed the surveillance campaign to go undetected.

Google, in response to the disclosures, has deactivated the problematic browser extensions. The full list of offending extension IDs can be accessed here.

Telemetry data has revealed that some of these extensions were active on the networks of “financial services, oil and gas, media and entertainment, healthcare and pharmaceuticals, retail, high-tech, higher education, and government organizations,” although there’s no evidence that they were actually used to collect sensitive data.

Recommendations:

It is recommended to consider the following best practices:

• Users should review extension permissions by visiting “chrome://extensions” on the Chrome browser, consider uninstalling those that are rarely used, or switch to other software alternatives that don’t require invasive access to browser activity.
• The users must always keep their browsers up-to-date so as to have the latest patches and less probability of getting affected.
• The users must never download any extensions from external sources.