Heads up, Google Chrome users: Researchers at enterprise security firm Icebrg recently discovered four malicious extensions in the official Google Chrome Web store.
The malicious extensions—named Change HTTP Request Header, Nyoogle, Lite Bookmarks, and Stickies—have affected more than half a million Google Chrome users, including workers at major organizations around the world, the researchers wrote in a Monday blog post.
"Although likely used to conduct click fraud and/or search engine optimization (SEO) manipulation, these extensions provided a foothold that the threat actors could leverage to gain access to corporate networks and user information," they added. Click fraud campaigns "enable a malicious party to earn revenue by forcing victim systems to visit advertising sites that pay per click," Icebrg wrote.
The windfall from this type of scheme can be massive. A similar botnet dubbed Chameleon, which had more than 120,000 host machines, cost advertisers $6 million per month before it was dismantled in 2013. It's unclear how much money the individuals behind this new batch of malicious Chrome extensions racked up from the scheme.
Moreover, malicious actors could use this same capability to "browse internal sites of victim networks, effectively bypassing perimeter controls that are meant to protect internal assets from external parties," Icebrg wrote.
The researchers discovered the malicious extensions while investigating a suspicious spike in outbound network traffic from a customer's workstation. It informed Google and other "relevant parties," including the United States Computer Emergency Readiness Team and the National Cyber Security Centre of The Netherlands (NCSC-NL).
It appears Google has since removed all four malicious extensions from the Chrome Web store.
Still, the researchers warn that the malware may still be present on impacted machines, even if the extensions are no longer available in the store. They may also still be available for download via third-party Chrome extension sources.
Google did not immediately respond to PCMag's request for comment.
The researchers warned that it's easy for organizations and individual users to overlook this threat.
"Coupling an extension marketplace style 'easy install' for users, limited understanding of the underlying risks, and few compensating controls leaves organizations vulnerable to a serious and easily overlooked attack vector," they wrote. "To a motivated threat actor, this approach presents a range of opportunities, from co-opting enterprise resources for advertising click-fraud to leveraging a user's workstation as a foothold into the enterprise network."