Over 2.3 Million Users Targeted by Malicious Chrome and Edge Extensions

A significant browser hijacking campaign has been uncovered, affecting over 2.3 million users through 18 malicious extensions on Google Chrome and Microsoft Edge. Cybersecurity experts revealed that these extensions, which masqueraded as harmless tools such as emoji keyboards, video speed controllers, weather applications, and VPN proxies, were initially safe. However, they later received updates containing malicious code. Once installed, these extensions monitored user activity, collected sensitive data, and redirected users to unsafe websites. Dubbed RedDirection, this campaign exploited the auto-update mechanisms of browsers, transforming trusted tools into Trojan-style spyware without user consent. Users are strongly urged to check for suspicious extensions, clear their browsing data, and conduct malware scans immediately. Investigations into the attack’s origins are currently underway.