Google Chrome Users Hit With Massive Spyware Campaign, Millions Exposed

A third-party security team uncovered a massive ring of Chrome spyware extensions that were all working together. The nefarious extensions had been downloaded a total of over 32 million times and impacted millions of Chrome browsers.

The researchers at Awake Security are coming forward after they informed Google of the Chrome spyware ring, and after Google removed over 70 identified extensions from the official Chrome Web Store last month. A Google spokesman said that after extensions are removed from the Web Store that violate policies, the incidents are used as training material to improve the automated and manual analysis systems.

Most of the illegitimate extensions discovered by the researchers claimed to warn users about questionable websites or to convert files between formats. What the extensions really did was steal browsing history and data that provided credentials for access to internal business tools. Based on the number of downloads, this was the most far-reaching malicious Chrome store campaign to date.

So far, Google has offered no insight into how the large ring of malicious extensions was able to evade detection for so long. The search giant did promise in the past that it would do more to supervise extensions offered to Chrome users, but instances like this show how far Google still needs to go. At this time, there is no indication of who was behind the distribution of the malware. Awake Security says that developers of the extensions gave false contact information.

Researchers report that the extensions would connect to a series of websites and transfer information when someone used the infected browser to surf the Internet. When the infected browsers were used on corporate networks, they would not transfer any sensitive information or reach out to malicious websites to evade security services. Chrome extensions such as these could be used for organized crime and even corporate espionage. A full listing of the tainted extensions can be found here.

In other Google Chrome news, the search giant was hit with a $5 billion lawsuit earlier this month, alleging that it was tracking users while they were using Chrome's Incognito mode.