An alarming cyber threat has come to light involving common browser extensions used by millions across the world. According to a recent investigation by cybersecurity firm Koi Security, at least 18 browser add-ons, once considered safe were secretly turned into tools to track users without their knowledge. The attack, named “RedDirection,” affected more than 2.3 million people.
What makes this case especially alarming is that many of these extensions were originally trusted. They included tools like emoji keyboards, volume boosters, and weather forecasts popular utilities often downloaded from official platforms like the Chrome Web Store and Microsoft Edge Add-ons Store. With high ratings and verified badges, they seemed completely legitimate.
However, after gaining a large number of users, the attackers behind the campaign quietly pushed harmful updates. These updates gave the extensions the ability to access users’ online activity, including the websites they visited, cookies, and even login information. In some cases, users were redirected to fake websites designed to steal sensitive data like passwords.
Extensions such as “Emoji keyboard online,” “Free Weather Forecast,” and “Volume Max” on Chrome, as well as “Unlock TikTok” and “Volume Booster” on Edge, were found to be connected to the same background server. This suggests that all of them may have been controlled by a single group or organization.
One of the biggest concerns is how easily these harmful changes were delivered. Most browser extensions update automatically in the background, with no alerts or approval required from users. This allowed attackers to silently take control of millions of browsers without anyone noticing.
This isn’t the first case of browser extensions being misused. Past incidents like the 2019 “DataSpii” leak and 2021’s “CursedChrome” attack followed a similar pattern, trustworthy tools were hijacked over time and repurposed for spying or data collection.
If you use browser extensions, it’s important to take action now. Open your browser settings (by typing chrome://extensions or edge://extensions in the address bar), review all installed extensions, and remove anything suspicious or unused. You should also clear your browsing history and run a full antivirus scan on your device.
To stay safe in the future, treat browser extensions carefully. Only install what you truly need, and review the permissions each extension asks for. Think of your extensions like apps on your phone or medications in your home, regular cleanups can prevent major problems.
This recent discovery reminds us that even trusted tools can be misused over time. Staying alert and informed is the best defense.