Hackers have eroticism monkeydiscovered a new way to remotely take control of your computer — all through the Google Chrome web browser.
A report from cybersecurity company SquareX lays out the new multifaceted cyberattack, which the firm has dubbed "browser syncjacking."
At the core of the attack is a social engineering element, as the malicious actor first must convince the user to download a Chrome extension. The Chrome extension is usually disguised as a helpful tool that can be downloaded via the official Chrome Store. It requires minimal permissions, further cementing its perceived legitimacy to the user. According to SquareX, the extension actually does usually work as advertised, in order to further disguise the source of the attack from the user.
Meanwhile, secretly in the background, the Chrome extension connects itself to a managed Google Workspace profile that the attacker has set up in advance. With the user now unknowingly signed into a managed profile, the attacker sends the user to a legitimate Google support page which is injected with modified content through the Chrome extension, telling the user they need to sync their profile.
When the user agrees to the sync, they unwittingly send all their local browser data, such as saved passwords, browsing history, and autofill information, to the hacker's managed profile. The hacker can then sign into this managed profile on their own device and access all that sensitive information.
The attack up to this point already provides the hacker with enough material to commit fraud and other illicit activities. However, browser syncjacking provides the hacker with the capability to go even further.
Using the teleconferencing platform Zoom as an example, SquareX explains that using the malicious Chrome extension, the attacker can send the victim to an official yet modified Zoom webpage that urges the user to install an update. However, the Zoom download that's provided is actually an executable file that installs a Chrome browser enrollment token from the hacker's Google Workspace.
After this occurs, the hacker then has access to additional capabilities and can gain access to the user's Google Drive, clipboard, emails, and more.
The browser syncjacking attack doesn't stop there. The hacker can take one further step in order to not just take over the victim's Chrome profile and Chrome browser, but also their entire device.
Through that same illicit download, such as the previously used Zoom update installer example, the attacker can inject a "registry entry to message native apps" by weaponizing Chrome’s Native Messaging protocol. By doing this, the attacker basically sets up a connection "between the malicious extension and the local binary." Basically, it creates a flow of information between the hacker's Chrome extension and your computer. Using this, the hacker can send commands to your device.
What can the hacker do from here? Pretty much anything they want. The attacker will have full access to the user's computer files and settings. They can create backdoors into the system. They can steal data such as passwords, cryptocurrency wallets, cookies, and more. In addition, they can track the user by controlling their webcam, take screenshots, record audio, and monitor everything input into the device.
As you can see, browser syncjacking is nearly completely unrecognizable as an attack to most users. For now, the most important thing you can do to protect yourself from such a cyberattack is to be aware of what you download and only install trusted Chrome extensions.
Topics Cybersecurity Google
HP Touchscreen Laptop deal: Get $240 off at Best Buy
Philips now allows customers to 3D print replacement parts
Best portable power station deal: Save $179.01 on the EcoFlow River 2 Max
Your 'wrong person' texts may be linked to Myanmar warlord
Wordle today: The answer and hints for January 28, 2025
The 10 Most Anticipated PC Games of 2016
Bomb Envy
Stablecoin bill advances in U.S. Senate as Trump critics call to end his crypto dealings
Trump's foreign aid freeze halts funding for digital diplomacy bureau
Best robot vacuum deal: Save $200 on Eufy X10 Pro Omni robot vacuum
Best air purifier deal: Save $300 on the Dyson HEPA Big + Quiet air purifier
How to Settle Down with Dystopia
Astronomers saw one galaxy impale another. The damage was an eye
Best robot vacuum deal: Save $140 on roborock Q7 Max Robot Vacuum
Clean energy projects soared in 2016 as solar and wind got cheaper
Best Garmin deal: Save over $100 on Garmin Forerunner 955
What cracked the Milky Way's giant cosmic bone? Scientists think they know.
Amazon Prime Grubhub deal: Save $10 off orders of $20 or more
Best Amazon deal: Save 20% on floral and botanical Lego sets
Stablecoin bill advances in U.S. Senate as Trump critics call to end his crypto dealings
Marvel wanted Wakandans in 'Black Panther' to have British accentsThis beautiful sunset cloud looks like a giant, magical unicorn penisThere was a silent but powerful #BlackLivesMatter protest at fashion weekNintendo just grew by $7.5 billion thanks to 'Pokémon Go'Apple sets up replacement program for certain defective iPhone 8 unitsIf you want baby soft skin, try this exfoliating mittClimate change could mean more bugs, bad things for the world's cropsClassic FM fans are having a field day with David Cameron's humming trackFather takes son on weeklong backpacking trip with $15 to get byPoliticians throw 404 error page shade at Britain's new prime minister'House of Cards' kills off Kevin Spacey's character: WatchTennis fan who dipped chicken fingers into her soda explains that it tastes... good?Annoyed eagle attempts to carry young boy away in AustraliaAretha Franklin's family calls her eulogy 'offensive and distasteful'Please enjoy this perfect prank Beyoncé's daughter Blue Ivy pulled on her grandmotherIf you want baby soft skin, try this exfoliating mittA truck full of Axe body spray blew up and the reactions are pricelessThere was a silent but powerful #BlackLivesMatter protest at fashion week'Pokémon Go' players are taping their phones to ceiling fans to hatch EggsDunkin' Donuts isn't trolling Patriots fans, but it's a nice thought This Dutch model looks EXACTLY like Gigi Hadid. Seriously, it's uncanny. A few ways Trump has been 'acting sharper' in meetings Netflix's 'The Haunting of Bly Manor' needs some decluttering: Review How a Facebook prank exposed anti Judge won't let 'Fortnite' back into App Store as Apple fight crawls on 9 ways science has been sexist Even this chicken sandwich is getting in on the Anthony Scaramucci fall out Triller follows TikTok in banning QAnon conspiracy content Here lies possibly the world's shortest political interview Amazon’s ‘What the Constitution Means to Me’ is a fiery call to action Gmail Go is now available to all Android users Trump called the White House 'a dump' and the internet wasn't having it Facebook finally bans anti Chelsea Clinton offers White House appreciation after Trump reportedly calls it a 'dump' 11 inspiring children’s books to teach kids about gender equality These wild quotes from Trump calls will make you hide under your desk 'Sesame Street' teaches kids how to stand up to racism in new special Facebook Messenger gets shiny new logo, chat themes 'Game of Thrones' star Sophie Turner said her social media followers help her land gigs Last minute iPhone 12 rumors: better zoom, more battery life
2.5719s , 8287.109375 kb
Copyright © 2025 Powered by 【eroticism monkey】,Information Information Network