McAfee researchers discovered Google Chrome extensions that steal users’ browsing activity. A total of five of these extensions would have been found.
We are talking about the following extensions: Netflix Party, Netflix Party 2, FlipShope, AutoBuy Flash Sales and an extension that allows you to take a screenshot. Netflix Party has the most downloads with 800k while AutoBuy Flash Sales has the lowest with 20k.
- Netflix Party (mmnbenehknklpbendgmgngeaignppnbe) — 800,000 downloads
- Netflix Party 2 (flijfnhifgdcbhglkneplegafminjnhn) — 300,000 downloads
- Full Page Screenshot Capture — Screenshotting (pojgkmkfincpdkdgjepkmdekcahmckjp) — 200,000 downloads
- FlipShope — Price Tracker Extension (adikhbfjdbjkhelbdnffogkobkekkkej) — 80,000 downloads
- AutoBuy Flash Sales (gbnahglfafmhaehbdmjedfhdmimjcbed) — 20,000 downloads
These extensions can detect and track when a user opens websites in their browser. In this case, the cookie created by the visitor is changed. Extensions run a multi-purpose script that is passed to scammers.
While the Netflix Party extensions have been removed, the screenshot and price tracker extensions are still available on the Chrome Web Store.
To avoid detection, some of the extensions will not activate their malicious tracking activity until 15 days after installation by the target. If you have any of this extension in your browser, remove it right now.