7 minmedium
When Productivity Extensions Become Attack Platforms
A coordinated campaign of 32 malicious browser extensions on Chrome and Edge stores used remote configuration to monitor browsing and run affiliate fraud, affecting 6,150+ users since March 2025. Extensions shared a common codebase with Korean development artifacts, retrieving Base64-encoded configuration from a jsDelivr-hosted endpoint to dynamically control navigation redirects. The webNavigation API enabled continuous browsing telemetry collection across all sites, not just those related to advertised functionality. A secondary cluster under the same publisher performed affiliate fraud by silently redirecting users through Coupang affiliate links.
Sens:▲ 24h
IOCs5
3url1domain1email
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Audit and remove all listed malicious extension IDs from managed browsers
- Block network access to api.pvmf.workers.dev
- Block access to the jsDelivr-hosted configuration URL path
Key Takeaways
- 32 extensions across Chrome and Edge stores shared identical background service workers and telemetry logic despite different branding.
- Remote config on jsDelivr allowed post-publication behavior changes without triggering browser store review.
- GitHub Korean extension had 4,000 installs, the highest in the campaign.
- Config values were Base64-encoded to obstruct manual inspection and automated static analysis.
- Attribution to a Korean-speaking actor based on Korean comments, localization, and shopping service use.
Attack Chain
- Initial Access: 32 malicious extensions published on Chrome and Edge stores disguised as productivity tools
- Execution: Extensions installed by users, background service workers activate on browsing events
- C2: Extensions retrieve Base64-encoded config from jsDelivr-hosted endpoint and cache locally
- Collection: webNavigation API monitors all completed browsing events across any website
- Impact: chrome.tabs.update() silently redirects matching hostnames to affiliate fraud links
Affected Systems
- Google Chrome browser with installed extensions
- Microsoft Edge browser with installed extensions
- Chrome Web Store users
- Microsoft Edge Add-ons Store users
- Users with extensions requesting webNavigation or all_urls permissions
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Extensions run within browser process; EDR sees network requests but not internal JavaScript logic or API calls. |
| Network Visibility | Medium | Requests to jsDelivr and workers.dev are visible but indistinguishable from legitimate CDN traffic without URL path correlation. |
| Detection Difficulty | Hard | Legitimate CDN hosting, Base64 obfuscation, and benign-looking extensions require multi-signal correlation to identify. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Browser extensions requesting webNavigation and <all_urls> permissions that fetch remote JSON config files (T1105) | Extension manifest permissions and outbound HTTP requests | Command and Control | Medium — legitimate extensions use remote config |
| Extensions invoking chrome.tabs.update() after webNavigation.onCompleted to redirect based on remote rules (T1565) | Browser extension API call logs and navigation events | Impact | Low — redirect after remote config is unusual |
| Multiple extensions sharing identical background service worker code from same publisher account (T1199) | Extension source code and publisher metadata | Initial Access | Low — code reuse across publishers is rare |
Required Log Sources
- Browser extension inventory logs
- DNS and HTTP proxy logs
- Chrome extension event logs
- Edge extension event logs
- Web proxy URL logs
Key Behavioral Indicators
- Extensions requesting webNavigation and <all_urls> permissions simultaneously
- chrome.storage.session.set calls storing nav_cfg_cache keys
- chrome.tabs.update() invoked after webNavigation.onCompleted events
- Multiple extensions sharing identical background service worker implementations
- Extensions fetching config from jsDelivr gh/ repository paths
- Korean localization resources in non-Korean-themed extensions
Control Gaps
- Browser stores don't inspect externally hosted configuration files for post-publication behavior changes
- EDR products lack visibility into browser extension internal JavaScript execution and API calls
- Static analysis hampered by Base64-encoded configuration values decoded only at runtime
- Legitimate CDN infrastructure (jsDelivr) used for C2 evades domain-based blocklists
False Positive Assessment
Medium — jsDelivr and Coupang are legitimate platforms; extension navigation monitoring overlaps with benign extensions. Correlation required.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Deploy browser extension allowlisting across enterprise-managed browsers
- Monitor DNS for queries to api.pvmf.workers.dev
- Inspect extension manifests for webNavigation and <all_urls> permission combinations
User Protection
- Remove unused extensions with broad URL or navigation monitoring permissions
- Verify extension publisher reputation and install counts before installation
Security Awareness
- Train users to verify extension permissions match advertised functionality
- Warn users that productivity extensions should not request all-URLs access
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping8 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Stealth
Tactic
Collection
Tactic
Command and Control
Tactic
Impact
Plain-Language Summary
Attackers published 32 fake productivity browser extensions on Chrome and Edge stores that secretly monitored browsing and redirected users to affiliate links for profit. The extensions downloaded hidden instructions from the internet, letting attackers change behavior after passing store security reviews. Over 6,150 users installed these extensions since March 2025. Users should remove unnecessary extensions, especially those requesting broad permissions to access all websites or monitor navigation.
Additional IOCs
- Other:
dblfldpldecohjpjgmhnigajjdjloega- Malicious extension: Youtube Detox, Chrome, 56 installsofgiffiieajicdflklkoapgndinhfacm- Malicious extension: Eye Rest Reminder, Chrome, 91 installsnokclhllnnnahhfbpibpmnahpepahklo- Malicious extension: Youtube Detox, Edge, 25 installskdkfbahpggclmigankbnjgmhimfoijkk- Malicious extension: Eye Rest Reminder, Edge, 24 installshgcmokdfbgnakiifclhfifdphfofmngp- Malicious extension: Quick Memo, Chrome, 89 installsffjagifkdpammmgijbglgkklomipinem- Malicious extension: Quick Memo, Edge, 127 installsmfnlknmbkfnlgcjebdogolbakcekohfj- Malicious extension: KoreaDropdown, Chrome, 825 installsddbhcdcfllihhljfboihdbpfddibkjjg- Malicious extension: Language Learning, Edge, 38 installsekoglbhkaeljnakpledcdpfojbjdllmb- Malicious extension: YouTube Summary, Edge, 51 installspllpmojagjlnbclefckhdebmlkjhhcfh- Malicious extension: Air Quality Monitor, Chrome, 17 installscogfipmojjaephpnihpeemgdmofhnaaj- Malicious extension: SnapShot, Chrome, 69 installspppcpccgdjdniohmegcejgamdnhilkml- Malicious extension: SnapShot, Edge, 18 installscoohonllohmhpbklloifbjjibeggijol- Malicious extension: Copy as Markdown, Edge, 102 installsbjdlhcllmhaiigiaibaoihlmheomjjgo- Malicious extension: YouTube Enhancer, Edge, 32 installsbodnffdkjnpeholiplcncfegnliheamk- Malicious extension: SEO Toolkit, Edge, 35 installsahagmkpannaempjmlijhejhaajoiibel- Malicious extension: Text Counter, Edge, 8 installsahemlacbncnpikgfoegfjfendahcahdl- Malicious extension: Web Highlighter, Edge, 10 installsieigeddfggngchfecpibaikoebaenpgm- Malicious extension: Page Ruler, Edge, 27 installsbahnaggfidlcllmceahngpllpaahkbkd- Malicious extension: Video Speed Controller, Edge, 13 installspncbphagfmgfopmhlbkifoonnbfdihbm- Malicious extension: Tab Manager, Edge, 5 installshbjfkpmmomlaghbembkhhaaegbnlaicf- Malicious extension: Scroll to Top, Edge, 35 installsnehmipanmmnkdpbjjfinnnlficndfhhd- Malicious extension: Web Highlighter, Chrome, 60 installseobmkhocignkllbfigodhemdefbjldcb- Malicious extension: Video Speed Controller, Chrome, 108 installsgajghfhmgcemdgjkamllmoejhkklphnc- Malicious extension: Holiday D-day, Chrome, 18 installspifjjafdfdkglnnkeahlcndkmknlgocm- Malicious extension: Reaction Time Test, Chrome, 60 installsndoihodpeipgbogeecdiphdkjpcjoofp- Malicious extension: Page Ruler, Chrome, 38 installsbjokekhmbkkgohiedecgkkfgppoghjji- Malicious extension: Reading Time, Chrome, 19 installsefieelkohffbjnblcmomcejjbapaipnh- Malicious extension: Scroll to Top, Chrome, 11 installsgbgdekgkmaaamplkcdaanpdokmjjcdbm- Malicious extension: Image Downloader, Chrome, 29 installsfkddfdhkgfneiibakfdhgpbkkcnnlook- Malicious extension: GitHub Korean, Chrome, 4000 installsebkkpkifaojdccgpaldnpclompdojmbh- Malicious extension: SEO Toolkit, Chrome, 22 installsiclkfegmbldfjjlgngidahinmhogbfna- Malicious extension: Auto Scroll, Chrome, 78 installsjocoenanieejnoookkphbljadiahaopd- Malicious extension: YouTube Summary, Chrome, 27 installs
Showing defanged values
- domainapi[.]pvmf[.]workers[.]devC2 API endpoint for extension communication
- emailindie05hacker[@]gmail[.]comThreat actor email address
- urlhxxps://cdn[.]jsdelivr[.]net/gh/chosanghyeon-dev/chosanghyeon-dev@main/cf[.]jsonRemote C2 configuration endpoint shared across extensions
- urlhxxps://link[.]coupang[.]com/a/dUnRI6Affiliate fraud redirect link
- urlhxxps://link[.]coupang[.]com/a/ej6z6UAffiliate fraud redirect link