If you're using any, it's recommended you remove them now. These are the 15 Chrome and 13 Edge extensions containing the malicious code.

'It could also be that the author sold the original extensions to someone else after creating them and then his client introduced the malware afterwards.'Īvast has reported the extensions to Google and Microsoft, both of whom are conducting investigations. 'Our hypothesis is that either the extensions were deliberately created with the malware built in, or the author waited for the extensions to become popular and then pushed an update containing the malware,' said Avast researcher Jan Rubin. Given the number of installs, it's likely been a lucrative payday for the perpetrators. Every time one of the extensions redirected a user to a third-party domain, the cybercriminals would receive a payment. The tracking was so blatantly unfriendly and dishonest toward the average user that. They perform a range of malicious activities, including redirecting users to ads and phishing sites, collecting personal data and browsing history, and downloading other malware onto the host device.Īvast says (via ZDNet) that the primary aim of the campaign was to hijack user traffic for monetary gains. In late 2019 Avast was caught tracking internet traffic via browser extensions for Chrome, Firefox, and Opera. The plug-ins, listed at the bottom of the page, are believed to have been installed by more than three million people.Ĭybersecurity giant Avast analyzed the extensions last month after the threat was identified by Czech researchers at CZ.NIC, noting that some of them have been active since at least December 2018.

What just happened? Researchers have discovered 28 browser extensions for both Chrome and Edge that contain malicious code.

Avast browser extension messages