NullMixer

The ad blocker that injects ads | Imperva

Malicious and unwanted browser extensions continued to pose a significant threat to users, including through official browser stores and add-ons disguised as legitimate tools. Kaspersky reported that from January 2020 through June 2022, more than 6 million users were blocked from downloading malware, adware, or riskware presented as browser extensions, with adware making up most detections. The report identified several prominent families, including WebSearch, DealPly-related extensions, AddScript, and FB Stealer, each using different delivery and monetization methods. The extensions were distributed through third-party software bundles, malicious updates, and cases where an extension changed hands or a developer account was hijacked after publication. Their activity ranged from affiliate abuse and cookie stuffing to covert script execution and credential theft, with FB Stealer highlighted as particularly dangerous because it steals Facebook session cookies and enables account hijacking. The findings underscored that browser extensions can become a persistent attack surface even when they appear benign, especially when users grant broad permissions or install unnecessary add-ons.

Threat in your browser: what dangers innocent-looking extensions hold for users | Securelist