Overview

• John Tuckner of Secure Annex has identified 35 Chrome extensions with over 4 million installs that exhibit spyware or infostealer-like behavior.
• The extensions share obfuscated code, connect to similar servers, and require sensitive permissions, including access to cookies and browsing activity.
• Most of these extensions are unlisted, making them accessible only via direct URLs, yet 10 have been awarded Google's 'Featured' badge for trustworthiness.
• Some extensions, like Fire Shield Extension Protection, claim to enhance security but instead display suspicious behaviors, including tracking user activity.
• Users are strongly advised to uninstall these extensions immediately due to significant privacy and security risks.