Cyberhaven: Latest Research Reveals 8 Additional Compromised Extensions Affecting 1.1 Million Users

Spin.AI’s latest research has uncovered 8 additional compromised browser extensions, used by 1.1 million users during the time of compromise. This discovery brings the total number of compromised extensions to 40, impacting 3.7 million users in total.

The fallout from the Cyberhaven cyberattack continues to escalate. New findings by Spin.AI reveal the scale of affected users targeted with compromised extensions is even larger than initially thought. The attack is now known to have compromised additional browser extensions, putting 3.7 million users at risk. 

January 28 Update

We processed our database with the remaining IOCs and did not find other extensions included as part of this attack campaign. We continue to monitor the six remaining compromised extensions still available on the marketplace for patches and will update the table in this post accordingly.

Brief Overview of the Cyberhaven Incident

The Cyberhaven cybersecurity incident first became known when its extension developer fell victim to a phishing attempt and consequently, had malicious code injected into its Chrome extension. After investigation by Cyberhaven, Secure Annex, and others, it was uncovered that this attack is part of a broader campaign to target Chrome Extension developers.

Spin.AI’s Exclusive Findings

In response to the Cyberhaven attack, our team of security researchers conducted an extensive investigation into the malicious extension campaign. We processed our database with the Indicators of Compromise (IOCs) published by others and noted the following findings:

1. No Spin.AI customers affected by phishing attempt: We reviewed the OAuth ID used in the phishing attempt and found no evidence of our customers falling victim to this phishing attempt.
2. 8 compromised extensions not previously reported: We processed our database using the IOCs and found the sclpfybn[.]com domain in 8 extensions that were not previously reported. These 8 extensions were used by 1.1 million users during the time of compromise.
3. Signs of this attack campaign starting in 2023: Thanks to our database, which maintains a history of all browser extensions, we found that the earliest the sclpfybn[.]com domain was detected was in September 2023. While many browser extensions were either quickly patched or removed from the Chrome Web Store, some browser extensions were compromised for over 300 days before receiving a patch. 
4. One extension was compromised earlier than initially reported: One extension (AI Shop Buddy/Amazon Search; epikoohpebngmakjinphfiagogjcnddm) was previously reported to be compromised in v2.7.3. Our database indicates the compromise really began in v2.7.0.

Spin.AI’s Newly Discovered Compromised Extensions

Our internal investigation uncovered an additional eight compromised extensions. These additional extensions affected approximately 1.1 million new users in addition to the original 2.6 million. The findings highlight the growing reach of the Cyberhaven attack. Below are the names and details of these newly identified extensions:

Known compromised browser extensions

The table below details the extensions that were first identified as compromised, along with affected versions, date of compromise, current patch status, and date of patch (if applicable). The total number of users from the initially known compromised extensions totaled 2.6 million.

Recommended actions

Whether it be individuals who may have downloaded or updated to one of the compromised extensions or organizations who may be impacted in a larger way, there are key takeaways and action items to be aware of.

Individual users and businesses are encouraged to take the following steps as soon as possible:

1. Verify whether the extension was used during the period it was compromised:  Take an inventory of the browser extensions and its version. If the compromised version was/is installed, uninstall or update them immediately.
2. Change Facebook password: The data exfiltration activities for this particular attack seemed to center around Facebook business accounts. It is important to make sure Facebook account passwords are reset to minimize the damage of potentially stolen cookies.
3. Enable Multi-Factor Authentication (MFA): This additional security layer makes it much more difficult to compromise user accounts.

The Cyberhaven attack shows that while third-party browser extensions and SaaS apps can increase productivity, they can also pose a significant security threat. We are committed to helping users stay informed and secure by sharing our security research with the community. To learn more about how our solution can protect your organization from similar threats:

• Talk to us: Schedule a call with our security specialists to discuss your organization’s risk exposure and ways to mitigate it.

As this story develops, we will continue to provide updates and findings to help you safeguard data and users from new and emerging attacks.

Frequently Asked Questions

Was this helpful?

Yes

No

Submit Cancel

Thanks for your feedback!