Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Chrome. Show all posts
Websites
browser extensions Chrome Cyber Security Emoji keyboard Websites

Over 2 Million Users Affected: Browser Extensions Turned Into Silent Spying Tools


An alarming cyber threat has come to light involving common browser extensions used by millions across the world. According to a recent investigation by cybersecurity firm Koi Security, at least 18 browser add-ons, once considered safe were secretly turned into tools to track users without their knowledge. The attack, named “RedDirection,” affected more than 2.3 million people.

What makes this case especially alarming is that many of these extensions were originally trusted. They included tools like emoji keyboards, volume boosters, and weather forecasts popular utilities often downloaded from official platforms like the Chrome Web Store and Microsoft Edge Add-ons Store. With high ratings and verified badges, they seemed completely legitimate.

However, after gaining a large number of users, the attackers behind the campaign quietly pushed harmful updates. These updates gave the extensions the ability to access users’ online activity, including the websites they visited, cookies, and even login information. In some cases, users were redirected to fake websites designed to steal sensitive data like passwords.

Extensions such as “Emoji keyboard online,” “Free Weather Forecast,” and “Volume Max” on Chrome, as well as “Unlock TikTok” and “Volume Booster” on Edge, were found to be connected to the same background server. This suggests that all of them may have been controlled by a single group or organization.

One of the biggest concerns is how easily these harmful changes were delivered. Most browser extensions update automatically in the background, with no alerts or approval required from users. This allowed attackers to silently take control of millions of browsers without anyone noticing.

This isn’t the first case of browser extensions being misused. Past incidents like the 2019 “DataSpii” leak and 2021’s “CursedChrome” attack followed a similar pattern, trustworthy tools were hijacked over time and repurposed for spying or data collection.

If you use browser extensions, it’s important to take action now. Open your browser settings (by typing chrome://extensions or edge://extensions in the address bar), review all installed extensions, and remove anything suspicious or unused. You should also clear your browsing history and run a full antivirus scan on your device.

To stay safe in the future, treat browser extensions carefully. Only install what you truly need, and review the permissions each extension asks for. Think of your extensions like apps on your phone or medications in your home, regular cleanups can prevent major problems.

This recent discovery reminds us that even trusted tools can be misused over time. Staying alert and informed is the best defense.

Read more »
OpenAI
AI integration AI Powered AI technology Browser ChatGPT Chrome Cyber Security Data collection data security Google Chrome Internet Browser OpenAI

OpenAI Launching AI-Powered Web Browser to Rival Chrome, Drive ChatGPT Integration

 

OpenAI is reportedly developing its own web browser, integrating artificial intelligence to offer users a new way to explore the internet. According to sources cited by Reuters, the tool is expected to be unveiled in the coming weeks, although an official release date has not yet been announced. With this move, OpenAI seems to be stepping into the competitive browser space with the goal of challenging Google Chrome’s dominance, while also gaining access to valuable user data that could enhance its AI models and advertising potential. 

The browser is expected to serve as more than just a window to the web—it will likely come packed with AI features, offering users the ability to interact with tools like ChatGPT directly within their browsing sessions. This integration could mean that AI-generated responses, intelligent page summaries, and voice-based search capabilities are no longer separate from web activity but built into the browsing experience itself. Users may be able to complete tasks, ask questions, and retrieve information all within a single, unified interface. 

A major incentive for OpenAI is the access to first-party data. Currently, most of the data that fuels targeted advertising and search engine algorithms is captured by Google through Chrome. By creating its own browser, OpenAI could tap into a similar stream of data—helping to both improve its large language models and create new revenue opportunities through ad placements or subscription services. While details on privacy controls are unclear, such deep integration with AI may raise concerns about data protection and user consent. 

Despite the potential, OpenAI faces stiff competition. Chrome currently holds a dominant share of the global browser market, with nearly 70% of users relying on it for daily web access. OpenAI would need to provide compelling reasons for people to switch—whether through better performance, advanced AI tools, or stronger privacy options. Meanwhile, other companies are racing to enter the same space. Perplexity AI, for instance, recently launched a browser named Comet, giving early adopters a glimpse into what AI-first browsing might look like. 

Ultimately, OpenAI’s browser could mark a turning point in how artificial intelligence intersects with the internet. If it succeeds, users might soon navigate the web in ways that are faster, more intuitive, and increasingly guided by AI. But for now, whether this approach will truly transform online experiences—or simply add another player to the browser wars—remains to be seen.
Read more »
Windows
2FA Chrome Katz malware Windows

New Malware Threat Puts Windows Users at Serious Risk — Protect Your Data Now

 

A dangerous new computer virus called Katz is spreading fast, and it's targeting people who use Windows devices. Once it sneaks into your system, it can steal almost everything — from passwords and emails to cryptocurrency wallets and even two-factor login codes.

Security researchers have raised alarms because this virus isn’t just stealing one type of information — it’s collecting anything it can get. That includes browser data, saved login details, private files, and more. And even though companies like Microsoft are working hard to fight these threats, hackers keep coming back with new tricks.


How This Malware Gets In

The Katz virus doesn’t use any fancy or rare method to infect devices. Instead, it spreads through common scams. These include fake emails, harmful ads, shady downloads, and suspicious search results. Once someone clicks the wrong thing, the virus quietly installs itself without any warning signs.

After it's in, it scans to see which web browser you’re using — like Chrome, Edge, or Brave — and then quietly runs in the background. While invisible to you, it's actively collecting your saved information.


What Data Is at Risk?

Here’s what this malware can steal from your device:

1. Website and app passwords

2. Login codes from two-factor authentication

3. Stored messages from chat platforms

4. Cryptocurrency wallets and backup phrases

5. Email account access

6. Game logins and saved payment methods

7. Wi-Fi and VPN passwords

8. Files from file transfer tools

9. Anything you copy to your clipboard

10. Screenshots of your screen

That’s a huge amount of personal data that could be misused.


How to Keep Yourself Safe

To avoid falling victim to this malware, follow these safety tips:

• Use strong, unique passwords for every account

• Turn on two-step login wherever available

• Don’t click on strange links or download unverified software

• Keep your system and apps updated

• Install a reliable antivirus tool and keep it active


Extra Steps for Companies

If you're managing devices at work, it’s also important to:

1.Watch for odd background processes or hidden files

2. Check for unknown files being created in unusual folders

3. Monitor network traffic for any suspicious activity

4. Be alert to any strange behavior in browser-related apps


This malware uses very sneaky methods, including social engineering, to trick people into clicking or installing it. But by being cautious and aware, you can stay one step ahead and protect your information.


Read more »
Opera
Chrome Cloud Internet malware Opera

Malware Campaign Uses Fake CAPTCHAs, Tricks Online Users


Researchers at Netskope Threat Labs have found a new malicious campaign that uses tricky tactics to distribute the Legion Loader malware. The campaign uses fake CAPTCHAs and CloudFlare Turnstile to trap targets into downloading malware that leads to the installation of malicious browser extensions. 

Malware campaign attacks users via fake CAPTCHAs

The hackers have attacked over 140 Netskope customers situated in Asia, North America, and Southern Europe throughout different segments, driven by the financial and tech sectors. 

Netskope has been examining different phishing and malware campaigns targeting users who look for PDF documents online. Hackers use tricky ways within these PDFs to resend victims to malicious websites or lure them into downloading malware. In the newly found campaign, they used fake CAPTCHAs and Cloudflare Turnstile to distribute the LegionLoader payload. 

Important stages in the attack chain

The infection begins with a drive-by download when a target looks for a particular document and is baited to a malicious site.

The downloaded file contains a fake CAPTCHA. If clicked, it redirects the user via a Clloudfare Turnstile CAPTCHA to a notification page. 

In the last step, victims are urged to allow browser notifications.

Attack tactic in detail

When a user blocks the browser notification prompt or uses a browser that doesn’t support notifications, they are redirected to download harmless apps like Opera or 7-Zip. However, if the user agrees to receive browser notifications, they are redirected to another Cloudflare Turnstile CAPTCHA. Once this is done, they are sent to a page with instructions on how to download their file.

The download process requires the victim to open the Windows Run window (win + r) and put content copied to the clipboard (ctrl + v), and “ execute it by pressing enter (we described a similar approach in a post about Lumma Stealer),” Netscope said. In this incident, the command in the clipboard uses the “ command prompt to run cURL and download an MSI file.” After this, the “command opens File Explorer, where the MSI file has been downloaded. When the victim runs the MSI file, it will execute the initial payload.”

Hackers use different tactics to avoid getting caught

To avoid detection, the campaign uses a legitimate VMware-signed app that sideloads a malicious DLL to run and load the LegionLeader payload. Later, a new custom algorithm is used to remove the LegionLeader shellcode loader. 

In the final stage, the hackers install a malicious browser extension that can steal sensitive info across different browsers, such as Opera, Chrome, Brave, and Edge. Netscope warns of an alarming trend where hackers are targeting users searching for PDF docs online via sophisticated tactics to install malware.

Read more »
MPIC
Chrome Cyber Security Google https Linting MPIC

Google sets new rules to improve internet safety through better website security

 




Google is taking major steps to make browsing the web safer. As the company behind Chrome, the most widely used internet browser, Google’s decisions shape how people all over the world experience the internet. Now, the company has announced two new safety measures that focus on how websites prove they are secure.


Why is this important?

Most websites use something called HTTPS. This means that the connection between your device and the website is encrypted, keeping your personal data private. To work, HTTPS relies on digital certificates that prove a website is real and trustworthy. These certificates are issued by special organizations called Certificate Authorities.

But hackers are always looking for ways to cheat the system. If they manage to get a fake certificate, they can pretend to be a real website and steal information. To prevent this, Google is asking certificate providers to follow two new safety processes.


The first method: double-checking website identity (MPIC)

Google is now supporting something called MPIC, short for Multi-Perspective Issuance Corroboration. This process adds more layers of checking before a certificate is approved. Right now, website owners only need to show they own the domain once. But this can be risky if someone finds a way to fake that proof.

MPIC solves the issue by using several different sources to confirm the website’s identity. Think of it like asking multiple people to confirm someone’s name instead of just asking one. This makes it much harder for attackers to fool the system. The group that oversees certificate rules has agreed to make MPIC a must-follow step for all providers.


The second method: scanning certificates for errors (linting)

The second change is called linting. This is a process that checks each certificate to make sure it’s made properly and doesn’t have mistakes. It also spots certificates that use outdated or weak encryption, which can make websites easier to hack.

Linting helps certificate providers stick to the same rules and avoid errors that could lead to problems later. Google has mentioned a few free tools that can be used to carry out linting, such as zlint and certlint. Starting from March 15, 2025, all new public certificates must pass this check before they are issued.


What this means for internet users

These changes are part of Google’s ongoing plan to make the internet more secure. When websites follow these new steps, users can be more confident that their information is safe. Even though these updates happen in the background, they play a big role in protecting people online.



Read more »
Malware Attack
Chrome Cyber Attacks Cyble Cyble research data security Data Theft Google Chrome security Malware Attack

Sophisticated Malware Bypasses Chrome App-Bound Encryption Using Dual Injection

 

Researchers at Cyble have identified a highly advanced malware attack that successfully bypasses Google Chrome’s App-Bound Encryption. This security feature was designed to prevent infostealer malware from accessing user data, particularly cookies. 

However, the newly discovered malware employs dual injection techniques to circumvent these defenses, allowing cybercriminals to extract sensitive credentials. The attack begins with a deceptive file distribution method. The malware is embedded within a ZIP file disguised as a PDF document. 

When opened, it executes a malicious LNK shortcut file that creates a scheduled task, running every 15 minutes. Another component of the attack is an XML project file, which is designed to appear as a PNG image, further tricking users into engaging with the malicious content.  

To execute its payload, the malware exploits MSBuild.exe, a legitimate Microsoft development tool. This enables it to run directly in system memory without creating detectable files on the disk, making it much harder for traditional security solutions to identify and stop the attack. The use of fileless execution techniques ensures that the malware operates stealthily while maintaining persistence on an infected system. 

A key aspect of this attack is its dual injection approach. The malware employs both Process Injection and Reflective DLL Injection to execute malicious code within legitimate system processes. This method allows it to blend in with normal activity while avoiding detection. By targeting Chrome’s security framework, the malware can extract encrypted login data, cookies, and other sensitive browser-stored information. 

The malware also leverages the Telegram Web API for command and control communications. This connection enables threat actors to issue remote commands, modify bot configurations, and control infected systems with minimal interference. The dynamic bot ID switching feature adds an additional layer of stealth, ensuring continued access even if parts of the attack infrastructure are disrupted. Cyble researchers noted that the malware appears to be specifically targeting organizations in Vietnam, particularly those in the telemarketing and sales industries.

However, the method it uses could be adapted for broader campaigns, posing a risk to businesses and individuals globally. The initial infection method remains unclear, but it likely involves phishing emails or malicious downloads.  

To mitigate the risk of such attacks, Cyble recommends implementing strict email attachment filtering, restricting the execution of unverified files, and enhancing user awareness about phishing threats. 

Organizations should also deploy advanced security solutions capable of detecting fileless malware attacks. The research highlights the evolving nature of cyber threats and the need for proactive cybersecurity measures to safeguard sensitive data.
Read more »
Privacy
Browsing Cache Chrome Cookies Privacy

Why Clearing Cache and Cookies Matters for Safe Browsing

 


It seems to be a minor step, clearing your cache and cookies, but it is really a big factor in improving online safety and making your browsing easier. While these tools are intended to make navigation on the web faster and easier, they can sometimes create problems. Let's break this down into simple terms to help you understand why refreshing your browser is a good idea.

What are cache and cookies?

Cache: Think of the cache as your browser's short-term memory. When you visit a website, your browser saves parts of it—like images, fonts, and scripts—so the site loads faster the next time. For example, if you shop online more often, product images or banners might pop out quickly because they have been stored in your cache. This feature improves your surfing speed and reduces internet usage.

Cookies: Cookies are tiny text files that are stored on your browser. They help the websites remember things about you, such as your login details or preferences. For instance, they can keep you logged in to your email or remember items in your shopping cart. There are two main types of cookies:  

  • First-party cookies: Created by the website you're visiting to improve your experience.
  • Third-party cookies: From other websites, usually advertisers, and will be tracking your activities across various different sites.

Why Cache and Cookies Can Be Slippery

Cache Risks: The cache does help speed up things. Sometimes, however, it creates problems. The files in the cache may get outdated or corrupt and hence load a website wrongly. Web hackers can exploit the cached data by "web cache poisoning" which makes the user download bad content.

Cookie Risks: Cookies can be misused too. If someone steals your cookies, they could access your accounts without needing your password. Third-party cookies are particularly invasive, as they track your online behavior to create detailed profiles for targeted advertising.  

Why Clear Cache and Cookies?  

1. Fix Website Problems: Clearing the cache deletes outdated files, helping websites function smoothly.  

2. Protect Your Privacy: Removing cookies stops advertisers from tracking you and reduces the risk of hackers accessing your accounts.  

3. Secure Common Devices: If you’re using a public or shared computer, clearing cookies ensures your data isn’t accessible to the next user.  

How to Clear Cache and Cookies  

 Here is a quick tutorial for Google Chrome.

1. Open the browser and click on the three dots in the top-right corner.  

2. Go to Settings and select Privacy and Security.  

3. Click Clear Browsing Data.  

4. Check the boxes for "Cookies and other site data" and "Cached images and files."  

5. Select a time range (e.g., last hour or all time) and click Clear Data.

Clearing your cache and cookies is essentially the refresh button for your browser. It helps resolve problems, increases security, and guarantees a smoother, safer browsing experience. Regularly doing this simple task can make all the difference to your online privacy and functionality.


Read more »
User Data
Amazon Chrome Cookie Data Facebook Safari Technology User Data

No More Internet Cookies? Digital Targeted Ads to Find New Ways


Google Chrome to block cookies

The digital advertising world is changing rapidly due to privacy concerns and regulatory needs, and the shift is affecting how advertisers target customers. Starting in 2025, Google to stop using third-party cookies in the world’s most popular browser, Chrome. The cookies are data files that track our internet activities in our browsers. The cookie collects information sold to advertisers, who use this for targeted advertising based on user data. 

“Cookies are files created by websites you visit. By saving information about your visit, they make your online experience easier. For example, sites can keep you signed in, remember your site preferences, and give you locally relevant content,” says Google.

In 2019 and 2020, Firefox and Safari took a step back from third-party cookies. Following their footsteps, Google’s Chrome allows users to opt out of the settings. As the cookies have information that can identify a user, the EU’s and UK’s General Data Protection Regulation (GDPR) asks a user for prior consent via spamming pop-ups. 

No more third-party data

Once the spine of targeted digital advertising, the future of third-party cookies doesn’t look bright. However, not everything is sunshine and rainbows. 

While giants like Amazon, Google, and Facebook are burning bridges by blocking third-party cookies to address privacy concerns, they can still collect first-party data about a user from their websites, and the data will be sold to advertisers if a user permits, however in a less intrusive form. The harvested data won’t be of much use to the advertisers, but the annoying pop-ups being in existence may irritate the users.

How will companies benefit?

One way consumers and companies can benefit is by adapting the advertising industry to be more efficient. Instead of using targeted advertising, companies can directly engage with customers visiting websites. 

Advances in AI and machine learning can also help. Instead of invasive ads that keep following you on the internet, the user will be getting information and features personally. Companies can predict user needs, and via techniques like automated delivery and pre-emptive stocking, give better results. A new advertising landscape is on its way.

Read more »
Subscribe to: Posts (Atom)