Popular Chrome and Edge extensions track user activity
The popular Color Picker Tool - Geco extension for Microsoft Edge and Google Chrome browsers, which was available in the respective stores of both companies, turned out to be infected with a virus that tracks user activity, The Register reports.
Color Picker Tool allows users to identify any color on web pages in the browser and copy it for later use. It has been downloaded over a thousand times on Microsoft Edge, and on Chrome, where it has since been removed, the extension has over 800 reviews with an average rating of 4.2.
According to researchers at Koi Security, the extension captures every browser session of users, tracks activity on various websites, and creates backdoors. However, the researchers note that Color Picker Tool is just the "tip of the iceberg" and part of a larger browser data theft campaign called RedDirection.
RedDirection includes 18 malicious extensions available in the Chrome and Edge stores. Each of them has the same tracking capabilities, and together they cover more than 2.3 million users across both browsers. The researchers also say that before injecting the malware into the browsers, these extensions were clean and did not pose any threat to users for years.
Here is a list of other malicious extensions in ID and name format:
- kgmeffmlnkfnjpgmdndccklfigfhajen — Emoji keyboard online — copy&past your emoji.
- dpdibkjjgbaadnnjhkmmnenkmbnhpobj — Free Weather Forecast
- gaiceihehajjahakcglkhmdbbdclbnlf — Video Speed Controller — Video manager
- mlgbkfnjdmaoldgagamcnommbbnhfnhf — Unlock Discord — VPN Proxy to Unblock Discord Anywhere
- eckokfcjbjbgjifpcbdmengnabecdakp — Dark Theme — Dark Reader for Chrome
- mgbhdehiapbjamfgekfpebmhmnmmcmemg — Volume Max — Ultimate Sound Booster
- cbajickflblmpjodnjoldpiicfmecmif — Unblock TikTok — Seamless Access with One-Click Proxy
- pdbfcnhlobhoahcamoefbfodpmklgmjm — Unlock YouTube VPN
- eokjikchkppnkdipbiggnmlkahcdkikp — Color Picker, Eyedropper — Geco colorpick
- ihbiedpeaicgipncdnnkikeehnjiddck — Weather
- jjdajogomggcjifnjgkpghcijgkbcjdi — Unlock TikTok
- mmcnmppeeghenglmidpmjkaiamcacmgm — Volume Booster — Increase your sound
- ojdkklpgpacpicaobnhankbalkkgaafp — Web Sound Equalizer
- lodeighbngipjjedfelnboplhgediclp — Header Value
- hkjagicdaogfgdifaklcgajmgefjllmd — Flash Player — games emulator
- gflkbgebojohihfnnplhbdakoipdbpdm — Youtube Unblocked
- kpilmncnoafddjpnbhepaiilgkdcieaf — SearchGPT — ChatGPT for Search Engine
- caibdnkmpnjhjdfnomfhijhmebigcelo — Unlock Discord