Feb 28, 2017

Chrome Users Forced By Websites to Install Extension Before Leaving

A recently found malvertising campaign is targeting the Chrome users and redirecting them to websites which they can’t leave without installing a malicious Chrome extension.


A recently found malvertising campaign is targeting the Chrome users and redirecting them to websites which they can’t leave without installing a malicious Chrome extension.

While this is not exactly a common practice among the malvertising, which generally redirects the users to places where a stronger malware can be delivered, including adware, ransomware, banking trojans.

The expert from Malwarebytes, Jérôme Segura said that these recent malvertising campaigns are targeting Chrome users and redirecting them to other scam sites, rather traditionally redirecting to malware-ridden sites.

Segura wrote saying,”This malvertising flow (an XML feed) demonstrates how the user is redirected to a fake site which is forcing them to install a Google Chrome extension. Enticing may, in fact be a euphemism, since in this case user is giving no choice other than to ‘Add Extension to Leave’, while their browser is just stuck in a never ending loop of those fullscreen modes,” Segura writes.

So what will happen once this extension is installed? It will make sure that it stays in hiding by using a 1×1 pixel image as the logo, which becomes a blank space next to the Chrome menu, where extensions are generally present. It also hooks the chrome://settings and chrome://extensions in such a way that any attempts to access these is automatically redirected to chrome://apps so that users cannot get the extension uninstalled.

The bad stuff is in a couple of JavaScript files. One has a connection to a command & control server where it can receive instructions on what to do next.

“The perpetrators behind this extension are checking for certain keywords within the current URL and blocking/redirecting if the conditions are met. For instance, if the user tries to visit the Malwarebytes website, the browser will immediately get redirected, first to a YouTube video, and then to one of various Potentially Unwanted Programs (PUPs), get-rich-quick schemes, and various other scams,” the blog reads.

authorarticle: Master3395


keywords: google, chrome

Previous Article
Next Article

Sponsored Ads:


Page 1 of 526  >  >>

Fast forward: What's coming in future versions of Chrome?


May 31, 2020 | Category: Google | Comments

Every time Google updates its browser, it publishes release notes aimed at enterprises to highlight upcoming additions, substitutions, enhancements, and modifications. Here's some of what's coming.

read more…

Claims Microsoft copied his work


May 30, 2020 | Category: General | Comments

Was even in for an interview.

read more…

Has launched Popcorn Time for games


May 29, 2020 | Category: IT | Comments

Make piracy even easier.

Vapor Store takes a new approach to piracy.

read more…

Page 1 of 526  >  >>