This newly discovered “polymorphic extension attack” creates pixel-perfect replicas of legitimate extensions’ icons, HTML popups, and workflows, making it nearly impossible for users to distinguish them from authentic extensions. SquareX’s research team has recently uncovered a sophisticated browser attack technique that allows malicious extensions to impersonate any extension installed on a victim’s browser. The attack even temporarily disables the legitimate extension, creating a seamless deception that tricks users into providing sensitive credentials to what they believe is their trusted tool. When users click on what appears to be their password manager, they’re actually interacting with the malicious extension, which captures their master credentials and secret keys before seamlessly returning control to the legitimate extension. When a target is identified, such as when a user visits a login page, the polymorphic extension temporarily disables the legitimate extension using Chrome’s API capabilities, then visually transforms its icon and interface to match the target. This attack is particularly concerning as it exploits legitimate Chrome functionality and uses permissions classified as medium risk, making it difficult to detect through standard security measures. The APIs used – activeTab, scripting, and chrome.management – are commonly used by legitimate extensions, allowing the malicious code to blend in with normal browser operations. After installation, the extension functions as promised to avoid raising suspicion while monitoring for high-value target extensions on the user’s browser. The attack exploits the human tendency to rely on visual cues for verification, particularly the extension icons on the pinned tab bar. What makes this attack particularly dangerous is that it targets high-value extensions such as password managers, cryptocurrency wallets, banking applications, and productivity tools. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. However, the polymorphic extension can silently replace these visual indicators at precisely timed moments, creating a perfect illusion that leads to credential theft. When users interact with these icons, they assume they’re engaging with legitimate extensions. For example, if a password manager is compromised, attackers obtain access to the victim’s entire credential vault, enabling them to access any associated service or account.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 10 Mar 2025 09:10:11 +0000