Steve Gibson (72:08)
Okay, we've talked about the graphite spyware before. You know, it's one of the Israeli companies, in this case Paragon Solutions, it's one of the more capable systems. But it's one thing to hear about it and another thing to see it. They made the mistake of exposing details of their graphite, saw their spyware control panel. The panel was exposed in photos from a demo day recently in the Czech Republic. The photos, which were immediately taken down as I whoopsie, didn't mean to show those revealed graphite's ability to extract messages from instant messaging clients, including WhatsApp, Signal, Telegram line, Snapchat, TikTok and more. We already know what well we are. We already know that WhatsApp and Signal are truly secure. And that telegram, well it probably is. Mostly because its encryption is so random and scrambled that no one has yet, as far as we know, been able to make heads or tails of it. Even though when we talked about this about a year ago, some researchers really tried. They're like what? We're not sure what this is doing. Anyway, the point is we've, as we've always observed, there is no threat from anyone monitoring their users communications on the outside. The threat is that once spyware arranges to gain a foothold inside a smartphone, it doesn't need to untangle Telegram's mess of crypto or fight with Moxie's triple ratchet in signal. All it needs to do is pretend to be the device's user, examine the decrypted state, you know, the decrypted data that that's presented on the device's screen and send that back to its Central headquarters. So those leaked photos conclusively demonstrated that once a smartphone has been, you know, lubed up with Paragon's graphite, none of its secrets will be safe from spying eyes. And as we know, this is the battle that Apple is in. I mean, and they really take this seriously. They've gone to, you know, every extreme imaginable just to keep this, this cat and mouse battle going on, trying to harden and then re harden and over harden and super harden their, their hardware platforms to, to keep the bad guys from getting into their devices. It's just amazing how this battle has continued. If it weren't so difficult to apply a useful security caution, might be beware anything that's too popular. We often see that bad guys are very quick and unfortunately clever about jumping on to anything for which there's a large demand. For example, fake charitable contribution sites invariably pop up following any natural disaster in the hope of cashing in on people's compassion, you know, for the plights of others. So I suppose we shouldn't be surprised to learn that some cretin has created A family of 30 malicious AI assistant browser extensions for Chrome. Of course, why wouldn't someone do that? AI is all the rage at the moment, and people are going to be looking around for AI this or that. So last Thursday, Layer X reported on their discovery, which they've named AI Frame, with the headline Fake AI Assistant Extensions targeting 260,000 Chrome users via injected iFrames they wrote. As generative AI tools like ChatGPT, Claude, Gemini and Grok become part of everyday workflows, attackers are increasingly exploiting their popularity to distribute malicious browser extensions. In this research, we uncovered a coordinated campaign of Chrome extensions posing as AI assistants for for summarization, chat writing and Gmail assistance. While these tools appear legitimate on the surface, they hide a dangerous architecture. Instead of implementing core functionality locally, they embed remote server controlled interfaces inside extension controlled surfaces and act as privileged proxies, granting remote infrastructure access to sensitive browser capabilities. So basically you install this and then you've created a tunnel from the bad guys backend server infrastructure into your browser. Not what anybody wants, they said. Across 30 different Chrome extensions, published under different names and extension IDs and affecting over 260,000 users, we observed the same underlying code base, permissions and back end infrastructure, meaning they're all from the same guy group, whatever. Critically, because a significant portion of each extension's functionality is delivered through remotely hosted components, their runtime behavior is determined by external server side changes rather than by code reviewed at install time in the Chrome Web Store and we should just pause to say there is something so wrong with the fact that this is even possible. The fact that the Chrome Web Store could be allowing extensions to then later change their own behavior by changing what's happening on the server side. So this entire the security of this whole aspect of the ecosystem is badly broken, they said. The campaign consists of multiple Chrome extensions that appear independent, each with different names, branding and extension IDs. In reality, all identified extensions share the same internal structure, the same JavaScript logic, the same permissions, and the same backend infrastructure. Across 30 extensions impacting more than 260,000 users, the activity represents a single coordinated operation rather than separate tools. Notably, several of the extensions in this campaign were featured by the Chrome Web Store. It's a featured extension by the Chrome Web Store, increasing their perceived legitimacy and exposure. The technique, commonly known as extension spraying, is used to evade takedowns and reputation based defenses. When one extension is removed, others remain available or are quickly republished under new identities. Although the extensions impersonate different AI assistants Claude, Chat, GPT, Gemini, Grok and generic AI Gmail tools, they all serve as entry points into the same back end controlled system. By leveraging the trust users place in well known AI names, you know, brand names such as Claude, ChatGPT, Gemini and Grok, attackers are able to distribute extensions that fundamentally break the browser security model. The use of full screen remote iframes combined with privileged API bridges transforms these extensions into general purpose access brokers capable of harvesting data, monitoring user behavior and evolving silently over time. While framed as productivity tools, their architecture is incompatible with reasonable expectations of privacy and transparency, which I would say is putting it mildly. As generative AI continues to gain popularity, defenders should expect similar campaigns to proliferate. Extensions that delegate core functionality to remote mutable infrastructure should be treated not as convenience tools, but as potential surveillance platforms. Amen. So yeah, more than a quarter million instances of browser extension downloads and installations which front for this single malicious campaign. We know that web browser extensions are super popular and arguably necessary. After all, we could be using the password manager of our choice today without them. But their diversity and popularity has overwhelmed Google's ability to examine and manage them such that today's web browser ecosystem creates serious vulnerabilities. And there's really no solution today except to just say be prudent. Only install from like really well known brands with you know, that have been around a long time and next that's not even the worst, would you believe two that was 30 extensions. Now we have 287 Chrome extensions found to be spying on 37.4 million users Chrome browser extensions the researcher in this case is actually they posted on Substack. Great research, despite the fact that they chose as their handle the Q continuum. Okay, they wrote. Although their research is great. They wrote, we built an automated scanning pipeline that runs Chrome inside a Docker container. This is great research. Routes all traffic through a man in the middle proxy and watches for outbound requests that correlate with the length of the URLs we feed it. That's very clever. So they feed that. They feed the browser URLs of different lengths and then although they're unable to see the detail, they look at the length of of the traffic which is passing to a remote server and see that if it's core, if it's correlating with the length of the URL, then it is almost certainly that URL encrypted. So they say using a leakage metric, we flagged 287 Chrome extensions that exfiltrate browsing history. Meaning you install this extension every single URL you visit in Chrome, even though just because the extension is sitting there in your pile of extensions, it is sending them all back to the extensions publisher. Complete breach of your privacy, they said. Those extensions collectively have 37.4 million installations. Roughly 1% of the global Chrome user base just disgroup.1%. The actors behind the leaks span the spectrum. Similar Web, Curly Doggo Office, Chinese actors, many smaller obscure data brokers, and a mysterious big Star Labs that appears to be an extended arm of Similar Web. They said the problem isn't new. In 2014, Weisbacher et al. Their research on malicious browser extensions demonstrated this. In 2018, Heaton showed that the popular Stylish theme manager was silently sending browser URLs to a remote server. These past reports caught our eye and motivated us to dig into this issue today. So Fast forward to 2025. Chrome Store now hosts roughly 240,000 extensions, right? So just shy of a quarter million browser extensions, how can they possibly know what they're all doing? Many of them they wrote with hundreds of thousands of users. We knew that we needed a scalable, repeatable method to measure whether an extension was actually leaking data in in the wild. It was shown in the past that Chrome extensions are used to exfiltrate brow user browser history that is then collected by data brokers such as Similar Web and Alexa. We try to prove this in in this report we. We try to prove in this report that Similar web is very much still active and collecting data. Why does it matter? They write there's a moral aspect to the whole issue. Imagine that you build your business model on data exfiltration via innocent looking extensions and using that data to sell them to big corporates. Well, that's how Similar web is getting part of the data. That should remind us that whatever software you're using for free and it's not open sourced, you should assume you are the product. The second aspect is that it puts the users into danger and potentially this could be used for corporate exfiltration. Even if only browsed URLs are exfiltrated, they typically contain personal identifications. That way bad actors that would pay for the raw traffic collected can try to target individuals. So anyway, they they go on at length. I just wanted to put this again on everyone's map. I again, I don't know. I don't know how to solve the problem. We want extensions that are powerful. Our extensions need to be powerful to be, for example, a password manager. You know, I fill out a form and. Bit warden sees the contents that I put in the form and says oh, I checked your domain. I don't have this in my library for you. Would you like me to add this to your, you know, password manager collection? And you just say yeah I do, I want that. And that's done. So super convenient. But consider what that means this extension can do. It sees you entering the plain text password and your username and it knows where you are, the whole URL. That's what these extensions have access to. And now we have an ecosystem in the Chrome web store of 240,000 of these extensions. Obviously many of them are spying on their users. In this case, These guys found 287 representing that have been downloaded by 37.4 million users representing around a 1% of the Chrome user base sending everywhere they go home.
