Chrome Users Forced By Websites to Install Extension Before Leaving

Google | Feb 28, 2017 | Master3395

A recently found malvertising campaign is targeting the Chrome users and redirecting them to websites which they can’t leave without installing a malicious Chrome extension.

While this is not exactly a common practice among the malvertising, which generally redirects the users to places where a stronger malware can be delivered, including adware, ransomware, banking trojans.

The expert from Malwarebytes, Jérôme Segura said that these recent malvertising campaigns are targeting Chrome users and redirecting them to other scam sites, rather traditionally redirecting to malware-ridden sites.

Segura wrote saying,”This malvertising flow (an XML feed) demonstrates how the user is redirected to a fake site which is forcing them to install a Google Chrome extension. Enticing may, in fact be a euphemism, since in this case user is giving no choice other than to ‘Add Extension to Leave’, while their browser is just stuck in a never ending loop of those fullscreen modes,” Segura writes.

So what will happen once this extension is installed? It will make sure that it stays in hiding by using a 1×1 pixel image as the logo, which becomes a blank space next to the Chrome menu, where extensions are generally present. It also hooks the chrome://settings and chrome://extensions in such a way that any attempts to access these is automatically redirected to chrome://apps so that users cannot get the extension uninstalled.

The bad stuff is in a couple of JavaScript files. One has a connection to a command & control server where it can receive instructions on what to do next.

“The perpetrators behind this extension are checking for certain keywords within the current URL and blocking/redirecting if the conditions are met. For instance, if the user tries to visit the Malwarebytes website, the browser will immediately get redirected, first to a YouTube video, and then to one of various Potentially Unwanted Programs (PUPs), get-rich-quick schemes, and various other scams,” the blog reads.

Keywords: google, chrome

Author: Master3395


comments powered by Disqus

Page 1 of 376  >  >>

Working hard to preserve all public posts on Google+


Mar 20, 2019 | Category: Google | Comments

Now it will not be long.

read more…

New Window Defender Extension Launches - Insecure Websites Open in Edge


Mar 19, 2019 | Category: General | Comments

Works in Chrome and Firefox.

read more…

Now the extensions have appeared - public testing is approaching


Mar 18, 2019 | Category: General | Comments

Found 82 extensions for new Edge.

As we interpret recently Microsoft's activity, we are not the long wait from a public testing period of their new Chromium-based browser. Last week we got a sneak peek at new Edge in some photos you can see here, and it was explained that the first tests only had support in 64-bit Windows 10.

read more…

Page 1 of 376  >  >>