In SquareX's demonstration, the attackers impersonate the 1Password password manager extension by first disabling the legitimate one using the 'chrome.management' API, or if the permissions aren't available, user interface manipulation tactics to hide it from the user. SquareX recommends that Google implement specific defenses against this attack, such as blocking abrupt extension icons and HTML changes on installed extensions or at least notifying users when this happens. The list of installed extensions is sent back to an attacker-controlled server, and if a targeted one is found, the attackers command the malicious extension to morph into the targeted one. A newly devised "polymorphic" attack allows malicious Chrome extensions to morph into browser extensions, including password managers, crypto wallets, and banking apps, to steal sensitive information. SquareX researchers also noted that Google wrongfully classifies the 'chrome.management' API as "medium risk," and it is extensively accessed by popular extensions such as page stylers, ad blockers, and password managers. To get a list of other installed extension, the malicious extension abuses the the 'chrome.management' API, which it was given access to during installation. The malicious script attempts to load a specific file or URL unique to targetted extensions, and if it loads, it can be concluded that the extension is installed. Simultaneously, the malicious extension switches its icon to mimic that of 1Password, changes its name accordingly, and displays a fake login popup that matches the appearance of the real one. Once the sensitive information is sent to the attackers, the malicious extension reverts to its original appearance, and the real extension is re-enabled, so everything appears normal again. If the malicious extension doesn't have this permission, SquareX says there's a second, stealthier way to achieve the same, involving resource injection onto web pages the victim visits. The attack begins with the submission of the malicious polymorphic extension on Chrome's Web Store. A demonstration of this attack can be seen below, where the malicious extension impersonates 1Password. SquareX uses an AI marketing tool as an example, which offers the promised functionality, tricking victims into installing and pinning the extension on their browser.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 06 Mar 2025 14:20:19 +0000