how it happened
- whophishing campaignaimed at extension developers
- the gapOAuth consentto an app posing as a policy tool
- thenevery installed copyupdated automatically
- the resultbrowser sessions stolenfor about a day, per researchers
what everyone assumed
Extensions are small helpers: a password manager, a grammar checker, a security tool that warns before data leaves. The good ones come from known companies, are listed in the official store and update automatically, which keeps them patched. An extension published by a security company, installed on purpose by the IT team, is about as trustworthy as browser software gets.
what happened
According to the timeline in Secure Annex’s analysis and Cyberhaven’s statements quoted there, on 24 December 2024 at about 17:24 UTC a Cyberhaven employee with access to the company’s Chrome Web Store account received an email claiming the extension broke store policy. The link led to a Google consent screen for an app called “Privacy Policy Extension”, and the employee granted it access to manage the store account. Two-step login did not help, because nothing was signed in with the employee’s password. The app received a token.
With that access the attacker published version 24.10.4 of the Cyberhaven extension. Chrome installs updates without asking when they request no new permissions, and this one did not. Researchers found it sending browser session data to an attacker’s domain that was live from 01:32 UTC on 25 December to 02:50 UTC on 26 December. Cyberhaven said the code targeted Facebook Ads and Facebook Business sessions and cookies. Secure Annex found its target list was configured from the attacker’s server and at one point also covered ChatGPT.
Cyberhaven detected the problem on 25 December at 23:54 UTC, removed the malicious version within an hour and published a clean version on 26 December. TechCrunch reported the extension had about 400,000 users in the store. Cyberhaven did not say how many installations received the bad update.
step by step
- companies install the extension on staff browsersIt comes from a security vendor and updates itself through the Chrome Web Store.
- 24 December 2024a Cyberhaven employee grants an app access to the store accountThe email claimed a policy violation; consent was enough, no password was taken.the assumption breaks here
- 25 December 2024a malicious version 24.10.4 is publishedBrowsers fetch it on their own and it starts sending session data to the attacker.
- 25–26 December 2024detected and replacedCyberhaven removes it within an hour of detection and ships a clean version on 26 December.
how it surfaced
Cyberhaven’s own team found it, and researchers then traced the same phishing approach to other extension developers. Sekoia listed 16 compromised extensions and dated parts of the attacker’s infrastructure back to at least December 2023. BleepingComputer later reported 35. Counts of affected users range from hundreds of thousands to several million, depending on the source.
An extension is whatever its latest update says it is.
The company had done nothing unusual: it published through the official store and its customers installed from it. The attacker needed one consent click from one person with publishing rights.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe maker of one extension clicks a convincing email and gives an attacker the right to publish.what it costs youThe next update runs in every browser that has it, inside your staff's logged-in sessions.
- or it goes like thisit happenedSolarWinds / Sunburst, 2020howA genuine, signed update from a certified vendor carries a backdoor.what leavesa quiet way into your networkwho ends up with ita state intelligence service
- or it goes like thisit happenedtj-actions/changed-files, 2025howA build helper everyone uses is hijacked and its versions repointed.what leavessecret keys, printed into build logswho ends up with itanyone reading public logs
sources
- Secure Annex: Cyberhaven extension compromise
- TechCrunch: Cyber firm's Chrome extension hijacked to steal user passwords (27 December 2024)
- Sekoia: Targeted supply chain attack against Chrome browser extensions
- BleepingComputer: New details reveal how hackers hijacked 35 Google Chrome extensions
- SecurityWeek: Cyberhaven Chrome extension hack linked to widening supply chain campaign
your turn
what you can do about it
this week
List the browser extensions installed across your company, and who publishes each one.
Your device management or Google Admin console can usually show installed extensions. Remove the ones nobody can explain, and note which of the rest can read every page your staff open. Cyberhaven's customers trusted the publisher, and the update came from the publisher's own store account.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →