New "Storm" infostealer skips local decryption, sending browser data to attacker servers. Varonis shows how server-side decryption enables session hijacking, bypassing passwords and MFA.
This new Storm attack platform can exfiltrate passwords and session data, enabling 2FA bypass. Google Chrome, Microsoft Edge ...
Security researchers at Varonis have uncovered a new information stealer malware (infostealer) strain that harvests browser ...
AI browser extensions increase enterprise risk with 60% higher vulnerabilities, bypassing DLP controls and exposing sensitive data.
More than 100 malicious extensions in the official Chrome Web Store are attempting to steal Google OAuth2 Bearer tokens, ...
LinkedIn is facing two lawsuits over its practice of scanning users’ browsers to determine which extensions they’re running.
A BrowserGate investigation alleges LinkedIn secretly scans over 6,000 browser extensions and builds device fingerprints ...
Researchers have determined that Microsoft's LinkedIn is scanning browser plug-ins and other information without permission, ...
Under New Management is a browser extension that monitors for changes of ownership in other extensions. The extension isn’t new, but it’s useful: Bad actors can acquire existing extensions to harvest ...
According to Socket, the extensions (complete list here) are published under five distinct publisher identities – Yana ...
LinkedIn runs a hidden JavaScript script called Spectroscopy that silently probes over 6,000 Chrome extensions and collects ...