[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbQ3s3TxhI0uPFLoUsf_PSkQHGU4D22eMxeb2Eu2CtTE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47,"controls":54},"1e88665c-fbc7-43c5-89d9-47a34bd76375","banned-chrome-extension-returns-to-steal-data-and-hijack-clicks","af4e680a-70f5-4f06-a449-81888e76f0ff","Banned Chrome Extension Returns to Steal Data and Hijack Clicks","A malicious Chrome extension that was previously removed for scraping sensitive AI conversations managed to reappear on the Chrome Web Store, demonstrating a critical weakness in third-party software vetting and platform enforcement. The extension shifted tactics from outright data theft to a covert affiliate monetization scheme, showing how threat actors adapt to evade detection while maintaining a persistent presence. This matters because users who trust official distribution channels like the Chrome Web Store may install extensions believing they have been vetted for safety. The incident highlights how supply chain risks extend to browser ecosystems, where a seemingly benign update can introduce or reactivate harmful behavior at any time.","**Immediate actions:**\n- Audit all currently installed browser extensions across your organization and remove any with unknown, unverified, or recently reinstated publishers.\n- Block or flag the specific extension IDs associated with the malicious actor using endpoint management or browser policy tools.\n\n**Long-term improvements:**\n- Establish an approved-extensions allowlist via enterprise browser policy (e.g., Google Workspace Admin or Intune) to prevent unauthorized extension installation.\n- Implement a periodic extension review process that re-evaluates installed extensions for permission changes, ownership transfers, or behavioral anomalies after updates.\n- Educate employees on the risks of browser extensions, including how legitimate-looking tools can exfiltrate sensitive data entered into AI platforms or other web applications.\n\n**Detection measures:**\n- Deploy endpoint detection tools or browser security solutions (e.g., Chrome Enterprise, CrowdStrike Falcon for Browsers) that monitor extension network activity and flag unusual outbound connections.\n- Enable logging of browser extension installations and updates within your SIEM to detect reappearance of previously banned or flagged extension IDs.",[12,13,14,15,16,17,18,19],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-3: Malicious Code Protection","GDPR Article 32: Security of Processing (data exfiltration risk)","NIST Cybersecurity Framework DE.CM-7: Monitoring for Unauthorized Software","ITIL: Change Management — Third-Party Software Vetting",{},"published","2026-08-11T12:20:36.200542+00:00","2026-08-11T12:20:35.895+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fwww.securityweek.com\u002Fextension-banned-for-stealing-ai-chats-returns-to-chrome-store-resumes-malicious-activities\u002F","extension-banned-for-stealing-ai-chats-returns-to-chrome-store-resumes-malicious-b5a6e3","Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"2fe9f2f5-d377-4d23-a4ff-1ee94eb53dbf","2026-08-11","afternoon","ThreatNoir Afternoon Brief — August 11","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-11\u002Fthreatnoir-afternoon-brief-2026-08-11.mp3",[55,59,63],{"slug":56,"name":57,"problem":58},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":60,"name":61,"problem":62},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":64,"name":65,"problem":66},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught."]