Regarding the Cyberhaven chrome extension compromise, there are other...
Essential information
- Published
- 27/12/2024 14:21
- Modified
- 27/12/2024 17:21
- Tags
- 2024-12-27 browser extensions chrome cyberhaven
- Related entities
- 14 observables, 5 techniques (mitre)
Description
Several Chrome extensions have been compromised, including those related to Cyberhaven. The affected extensions are linked to multiple suspicious domains resolving to the same IP address as cyberhavenext[.]pro. Some confirmed compromised extensions are listed with their corresponding URLs. Users are advised to search for these extensions in their environments and monitor for any traffic to the IP address 149.28.124[.]84. This information suggests a widespread attack targeting browser extensions, potentially putting users' data and privacy at risk.
External references
- https://therecord.media/cyberhaven-hack-google-chrome-extension
- https://www.linkedin.com/posts/jaimeblasco_regarding-the-cyberhaven-chrome-extension-activity-7278237969637941248-qBEj/
- https://www.linkedin.com/posts/jaimeblasco_regarding-the-cyberhaven-chrome-extension-activity-7278237969637941248-qBEj?utm_source=share&utm_medium=member_ios
- https://otx.alienvault.com/pulse/676eb7ea8d206aea4fcd8efd