NewsPublished 23 Dec 2025

Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites

Source Reddit InfoSec News

Description

Two malicious Chrome extensions have been discovered stealing user credentials from over 170 websites without user consent. These extensions covertly capture login information, posing significant risks to user privacy and organizational security. The threat exploits the trust users place in browser extensions, enabling attackers to harvest sensitive data across a wide range of online services. European organizations using Chrome browsers are at risk, especially if employees install these extensions. The attack does not require user interaction beyond installation, and no authentication bypass is needed once the extension is active. Mitigation involves immediate removal of the malicious extensions, restricting extension installations via enterprise policies, and educating users about extension risks. Countries with high Chrome usage and significant digital service adoption, such as Germany, France, and the UK, are particularly vulnerable. Given the broad scope and ease of exploitation, this threat is assessed as high severity. Defenders should prioritize detection and removal of these extensions and monitor for suspicious credential access patterns.

Impact

For European organizations, the impact of this threat can be substantial. Credential theft can lead to unauthorized access to corporate accounts, including email, cloud services, and internal applications, potentially resulting in data breaches, intellectual property theft, and financial losses. The widespread nature of the affected sites increases the likelihood that employees use these services for work, amplifying risk. Compromised credentials can facilitate phishing campaigns, lateral movement within networks, and deployment of ransomware or other malware. The threat undermines user trust in browser extensions and complicates endpoint security management. Organizations with remote or hybrid workforces are particularly vulnerable if employees install extensions on personal devices used for work. Additionally, regulatory compliance risks arise if stolen credentials lead to data breaches involving personal data protected under GDPR, potentially resulting in fines and reputational damage. The threat also stresses the importance of multi-factor authentication (MFA) to mitigate the impact of stolen credentials.

Defensive guidance

To mitigate this threat, European organizations should implement strict browser extension management policies, including whitelisting approved extensions and blocking all others. Endpoint security solutions should be configured to detect and alert on suspicious extension installations or behaviors. Regular audits of installed extensions on corporate devices are essential. User education campaigns must emphasize the risks of installing unverified extensions and encourage verification of extension sources and permissions. Enforcing multi-factor authentication across all critical services will reduce the risk of account compromise even if credentials are stolen. Network monitoring should be enhanced to detect unusual authentication attempts or data exfiltration patterns. Organizations should also collaborate with IT and security teams to promptly remove any identified malicious extensions and update incident response plans to address browser-based threats. Finally, leveraging browser management tools provided by Google Workspace or Microsoft Endpoint Manager can help centrally control extension policies.

Summary

The reported security threat involves two malicious Chrome browser extensions that have been identified stealing credentials from users across more than 170 websites. These extensions operate covertly, capturing usernames and passwords entered by users on targeted sites and transmitting this sensitive information to attackers. The extensions likely masquerade as legitimate or useful tools to entice users into installing them, thereby bypassing suspicion. The absence of affected version details suggests these extensions may have been available for some time before detection. Although there are no known exploits actively leveraging this threat in the wild, the capability to harvest credentials from a wide range of sites presents a significant risk for account takeover, identity theft, and further lateral attacks within organizations. The technical details indicate the source of information is a trusted cybersecurity news outlet, corroborated by Reddit InfoSec community discussions, lending credibility to the report. The threat exploits the trust users place in browser extensions and the extensive permissions these extensions can have, including access to web page content and user input. This attack vector is particularly dangerous because it bypasses traditional endpoint security measures that may not monitor browser extension behavior closely. The lack of patches or updates implies mitigation relies on detection and removal rather than software fixes. Organizations relying heavily on Chrome browsers must be vigilant to prevent credential leakage through such extensions.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Dec 2025, 18:43 UTC

Technical details

References

Community reviews

Related threats