Researchers Expose New Polymorphic Attack That Clones Browser Extensions to Steal Credentials

Summary: Cybersecurity researchers have unveiled a technique where malicious web browser extensions can impersonate legitimate ones, creating a highly convincing replica that can deceive users into giving away sensitive credentials. This attack affects all Chromium-based browsers, exploiting users’ reliance on visual cues such as extension icons. The findings were published following another alarming method called Browser Syncjacking, which allows for device control via browser extensions.

Affected: All Chromium-based web browsers (Google Chrome, Microsoft Edge, Brave, Opera, etc.)

Keypoints :

• Malicious extensions can create pixel-perfect replicas of legitimate add-ons.
• They can temporarily disable the real extension to further deceive users.
• Harvested credentials can be misused for hijacking online accounts and accessing sensitive information.
• The attack harnesses visual cues and users’ habits of pinning extensions for operation.
• This method raises significant concerns about user security and extension authenticity.