Do Son 60 OffiDocs Chrome extensions with 2.3M installs secretly send browsing URLs. See how these spying Chrome extensions work and how to stay safe.
Chrome Web Store
The Chrome Manifest V2 removal is complete: Google has purged all legacy MV2 extensions from the Web Store, the final step of its MV3 migration.
uBlock Origin v1.74.0 marks the final Chrome release before Google removes all Manifest V2 extensions from the Chrome Web Store on August 31, 2026.
Google will remove all MV2 extensions from the Chrome Web Store on August 31, 2026. Back up your CRX files now before they are gone.
Once a "Featured" tool, the ShotBird extension now delivers malware via "vibecoded" scripts and fake updates. Remove it now to protect your passwords and data.
Microsoft Defender uncovers a massive campaign of malicious Chromium extensions impersonating AI tools to steal data from 900,000 users. Audit browsers now.
500k VK accounts hijacked by "VK Styles" extensions. Malware forces subscriptions and bypasses CSRF tokens. Remove the extension immediately.
LayerX exposes 30+ malicious AI extensions spying on 260,000 users. These "privileged proxies" steal Gmail data & page content. Uninstall now.
Trust Wallet hit by an $8.5M heist after Shai-Hulud hackers poisoned the NPM supply chain. Binance is fully compensating affected version 2.68 users.
Koi Security exposed ShadyPanda, which infected 4.3M+ users by weaponizing trusted browser extensions (WeTab, Clean Master) through auto-updates. The malware performs RCE and exfiltrates data to China.
LayerX exposed a 6-year, 9M-install campaign: Fake VPN/ad-blocking Chrome extensions hijack all user traffic via remote PAC proxy scripts, enabling surveillance and data exfiltration.
Unit 42 exposed the Smishing Triad, a PhaaS network that registered 194K+ malicious domains for global smishing. The group impersonates postal/banking services and uses Telegram for its underground market.
Symantec found over 21 million Chrome extension users at risk due to hardcoded API keys and secrets, potentially leading to data manipulation and financial loss.
Beware of EditThisCookie®: the malicious browser extension designed to steal user cookies and post phishing content through social media accounts.
Uncover the details of a sophisticated Chrome extension threat campaign: how phishing, credential theft, and malicious code impacted developers and end users.
Uncover the stealthy tactics of a Potentially Unwanted Application (PUA) masquerading as a PDF conversion tool. Learn how persistence mechanisms are exploited by threat actors to maintain control.