Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware!
TL;DR - An investigation of a single “verified” color picker exposed a coordinated campaign of 18 malicious extensions that infected a massive 2.3 million users across Chrome and Edge...
If you think a Chrome extension with #Google’s verified badge, 100,000+ installs, 800+ reviews, and featured placement on the store is trustworthy? Think again... Meet “Color Picker, Eyedropper — Geco colorpick”, an extension that perfectly demonstrates how sophisticated threat actors are exploiting the trust signals we rely on. This isn’t some obvious scam extension thrown together in a weekend. This is a carefully crafted trojan horse that delivers exactly what it promises (a functional color picker) while simultaneously hijacking your browser, tracking every website you visit, and maintaining a persistent command and control backdoor. Not only that, but it remained legitimate for years before becoming malicious through a version update.
If that is not enough, meet the RedDirection campaign. Our investigation into the Color Picker extension revealed it was just the tip of the iceberg. By analyzing the command and control infrastructure and tracking similar code patterns, we uncovered what we’re calling the RedDirection campaign, a sophisticated cross-platform network of eighteen malicious extensions spanning both #Chrome and #Edge stores, all sharing the same hijacking functionality. Combined, these eighteen extensions have infected over 2.3 million users across both browsers, creating one of the largest browser hijacking operations we’ve documented.
These extensions masquerade as popular productivity and entertainment tools across diverse categories: emoji keyboards, weather forecasts, video speed controllers, #VPN proxies for #Discord and #TikTok, dark themes, volume boosters, and #YouTube unblockers. Each provides legitimate functionality while secretly implementing the same browser surveillance and hijacking capabilities we discovered in the color picker.
Several of these extensions have achieved verified status or featured placement across both the Chrome Web Store and Microsoft Edge Add-ons store, demonstrating that security failures extend across both major browser marketplaces. Each extension operates with its own command and control subdomain (like admitclick.net, click.videocontrolls.com, c.undiscord.com), giving the appearance of separate operators while actually being part of the same centralized attack infrastructure spanning both platforms.
▶️ Read On
https://t.me/InformationTechnologySecurity
TL;DR - An investigation of a single “verified” color picker exposed a coordinated campaign of 18 malicious extensions that infected a massive 2.3 million users across Chrome and Edge...
If you think a Chrome extension with #Google’s verified badge, 100,000+ installs, 800+ reviews, and featured placement on the store is trustworthy? Think again... Meet “Color Picker, Eyedropper — Geco colorpick”, an extension that perfectly demonstrates how sophisticated threat actors are exploiting the trust signals we rely on. This isn’t some obvious scam extension thrown together in a weekend. This is a carefully crafted trojan horse that delivers exactly what it promises (a functional color picker) while simultaneously hijacking your browser, tracking every website you visit, and maintaining a persistent command and control backdoor. Not only that, but it remained legitimate for years before becoming malicious through a version update.
If that is not enough, meet the RedDirection campaign. Our investigation into the Color Picker extension revealed it was just the tip of the iceberg. By analyzing the command and control infrastructure and tracking similar code patterns, we uncovered what we’re calling the RedDirection campaign, a sophisticated cross-platform network of eighteen malicious extensions spanning both #Chrome and #Edge stores, all sharing the same hijacking functionality. Combined, these eighteen extensions have infected over 2.3 million users across both browsers, creating one of the largest browser hijacking operations we’ve documented.
These extensions masquerade as popular productivity and entertainment tools across diverse categories: emoji keyboards, weather forecasts, video speed controllers, #VPN proxies for #Discord and #TikTok, dark themes, volume boosters, and #YouTube unblockers. Each provides legitimate functionality while secretly implementing the same browser surveillance and hijacking capabilities we discovered in the color picker.
Several of these extensions have achieved verified status or featured placement across both the Chrome Web Store and Microsoft Edge Add-ons store, demonstrating that security failures extend across both major browser marketplaces. Each extension operates with its own command and control subdomain (like admitclick.net, click.videocontrolls.com, c.undiscord.com), giving the appearance of separate operators while actually being part of the same centralized attack infrastructure spanning both platforms.
▶️ Read On
https://t.me/InformationTechnologySecurity
😱3🤬1
Microsoft links Sharepoint attacks to Chinese hacking groups
Several hacking groups with ties to the Chinese government have been linked to a recent wave of widespread attacks targeting a Microsoft SharePoint zero-day vulnerability chain.
They used this exploit chain (dubbed "ToolShell") to breach dozens of organizations worldwide after hacking into their on-premise SharePoint servers.
"Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon exploiting these vulnerabilities targeting internet-facing SharePoint servers," Microsoft said in a Tuesday report. "In addition, we have observed another China-based threat actor, tracked as Storm-2603, exploiting these vulnerabilities. Investigations into other actors also using these exploits are still ongoing."
https://t.me/InformationTechnologySecurity
Several hacking groups with ties to the Chinese government have been linked to a recent wave of widespread attacks targeting a Microsoft SharePoint zero-day vulnerability chain.
They used this exploit chain (dubbed "ToolShell") to breach dozens of organizations worldwide after hacking into their on-premise SharePoint servers.
"Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon exploiting these vulnerabilities targeting internet-facing SharePoint servers," Microsoft said in a Tuesday report. "In addition, we have observed another China-based threat actor, tracked as Storm-2603, exploiting these vulnerabilities. Investigations into other actors also using these exploits are still ongoing."
https://t.me/InformationTechnologySecurity
Telegram
Information Technology Security
All sorts of technology headlines and rumors, as well as photos, videos and tricks.
Discussion Group: @DiscussTheNews
Directory: @Z9Network
Website: www.Z9Network.com
Discussion Group: @DiscussTheNews
Directory: @Z9Network
Website: www.Z9Network.com
😱1
TransUnion says hackers stole 4.4 million customers’ personal information
Credit reporting giant TransUnion has disclosed a data breach affecting more than 4.4 million customers’ personal information.
In a filing with Maine’s attorney general’s office on Thursday, TransUnion attributed the July 28 breach to unauthorized access of a third-party application storing customers’ personal data for its U.S. consumer support operations.
TransUnion claimed “no credit information was accessed,” but provided no immediate evidence for its claim. The data breach notice did not specify what specific types of personal data were stolen.
In a separate data breach disclosure filed later on Thursday with Texas’ attorney general’s office, TransUnion confirmed that the stolen personal information includes customers’ names, dates of birth, and Social Security numbers.
https://t.me/InformationTechnologySecurity
Credit reporting giant TransUnion has disclosed a data breach affecting more than 4.4 million customers’ personal information.
In a filing with Maine’s attorney general’s office on Thursday, TransUnion attributed the July 28 breach to unauthorized access of a third-party application storing customers’ personal data for its U.S. consumer support operations.
TransUnion claimed “no credit information was accessed,” but provided no immediate evidence for its claim. The data breach notice did not specify what specific types of personal data were stolen.
In a separate data breach disclosure filed later on Thursday with Texas’ attorney general’s office, TransUnion confirmed that the stolen personal information includes customers’ names, dates of birth, and Social Security numbers.
https://t.me/InformationTechnologySecurity
❤2
US chip exports deepen AI ties with Saudi Arabia and the UAE
🔘 The US cleared exports of up to 35,000 Nvidia Blackwell AI chips to G42 and Humain.
🔘 The move deepens US–Gulf AI ties despite some lawmakers’ concerns.
The US Commerce Department has approved the export of advanced #AI chips to two firms in #SaudiArabia and the #UAE. The authorization covers the equivalent of up to 35,000 #Nvidia Blackwell chips, which are central to large-scale AI training.
The two buyers — G42 in #AbuDhabi and Humain in Saudi Arabia — are working on major data center projects in their countries. The timing of the approval matched the return of Saudi Crown Prince #MohammedBinSalman to the #US for the first time since 2018. It also signalled US support for the two governments’ AI ambitions.
In its statement, the Commerce Department said both companies can buy up to 35,000 Blackwell chips, though the total value can vary. A full batch would be worth about $1 billion. The agency said the approvals come with “rigorous security and reporting requirements.”
Earlier in the day, Humain said it plans to buy 600,000 Nvidia AI chips. Humain is also working with #ElonMusk’s #xAI to develop large-scale data centers in Saudi Arabia, including a planned 500-megawatt site.
The UAE praised the US decision. Ambassador Yousef Al Otaiba said the approval reflects ongoing talks between the two governments and shows their trust in each other on technology and security.
G42 aims to build one of the largest data center hubs in the world using US technology. Nvidia, #OpenAI, #Cisco, #Oracle and #SoftBank are involved in its first phase, called Stargate UAE, which is set to go live in 2026.
https://t.me/InformationTechnologySecurity
🔘 The US cleared exports of up to 35,000 Nvidia Blackwell AI chips to G42 and Humain.
🔘 The move deepens US–Gulf AI ties despite some lawmakers’ concerns.
The US Commerce Department has approved the export of advanced #AI chips to two firms in #SaudiArabia and the #UAE. The authorization covers the equivalent of up to 35,000 #Nvidia Blackwell chips, which are central to large-scale AI training.
The two buyers — G42 in #AbuDhabi and Humain in Saudi Arabia — are working on major data center projects in their countries. The timing of the approval matched the return of Saudi Crown Prince #MohammedBinSalman to the #US for the first time since 2018. It also signalled US support for the two governments’ AI ambitions.
In its statement, the Commerce Department said both companies can buy up to 35,000 Blackwell chips, though the total value can vary. A full batch would be worth about $1 billion. The agency said the approvals come with “rigorous security and reporting requirements.”
Earlier in the day, Humain said it plans to buy 600,000 Nvidia AI chips. Humain is also working with #ElonMusk’s #xAI to develop large-scale data centers in Saudi Arabia, including a planned 500-megawatt site.
The UAE praised the US decision. Ambassador Yousef Al Otaiba said the approval reflects ongoing talks between the two governments and shows their trust in each other on technology and security.
G42 aims to build one of the largest data center hubs in the world using US technology. Nvidia, #OpenAI, #Cisco, #Oracle and #SoftBank are involved in its first phase, called Stargate UAE, which is set to go live in 2026.
https://t.me/InformationTechnologySecurity
Instagram denies breach amid claims of 17 million account data leak
#Instagram says it fixed a bug that allowed threat actors to mass-request password reset emails, amid claims that data from more than 17 million Instagram accounts was scraped and leaked online.
"We fixed an issue that allowed an external party to request password reset emails for some Instagram users," a Meta spokesperson said.
"We want to reassure everyone there was no breach of our systems and people's Instagram accounts remain secure. People can disregard these emails and we apologize for any confusion this may have caused."
A media frenzy over an alleged Instagram data breach began after Malwarebytes warned its customers that cybercriminals had stolen data from 17.5 million accounts.
https://t.me/InformationTechnologySecurity
#Instagram says it fixed a bug that allowed threat actors to mass-request password reset emails, amid claims that data from more than 17 million Instagram accounts was scraped and leaked online.
"We fixed an issue that allowed an external party to request password reset emails for some Instagram users," a Meta spokesperson said.
"We want to reassure everyone there was no breach of our systems and people's Instagram accounts remain secure. People can disregard these emails and we apologize for any confusion this may have caused."
A media frenzy over an alleged Instagram data breach began after Malwarebytes warned its customers that cybercriminals had stolen data from 17.5 million accounts.
https://t.me/InformationTechnologySecurity
🤔3
#Snowflake’s #OpenIA deal signals enterprises will hedge across model vendors to balance cost, performance, and governance as #AI moves from pilots into production
▶️ more
https://t.me/InformationTechnologySecurity
▶️ more
https://t.me/InformationTechnologySecurity
TechCrunch
What Snowflake’s deal with OpenAI tells us about the enterprise AI race | TechCrunch
Snowflake is the latest enterprise to sign multi-year deals with multiple AI companies in what could be a sign to come of a future trend.
❤2
Iran-linked hackers tied to a cyberattack on U.S. company Stryker
A hacktivist group with links to #Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of #Ireland, Stryker's largest hub outside of the #US, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker's main U.S. headquarters says the company is currently experiencing a building emergency.
https://t.me/InformationTechnologySecurity
A hacktivist group with links to #Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of #Ireland, Stryker's largest hub outside of the #US, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker's main U.S. headquarters says the company is currently experiencing a building emergency.
https://t.me/InformationTechnologySecurity
❤2