Hackers have homo eroticism in the scarlet letterdiscovered a new way to remotely take control of your computer — all through the Google Chrome web browser.
A report from cybersecurity company SquareX lays out the new multifaceted cyberattack, which the firm has dubbed "browser syncjacking."
At the core of the attack is a social engineering element, as the malicious actor first must convince the user to download a Chrome extension. The Chrome extension is usually disguised as a helpful tool that can be downloaded via the official Chrome Store. It requires minimal permissions, further cementing its perceived legitimacy to the user. According to SquareX, the extension actually does usually work as advertised, in order to further disguise the source of the attack from the user.
Meanwhile, secretly in the background, the Chrome extension connects itself to a managed Google Workspace profile that the attacker has set up in advance. With the user now unknowingly signed into a managed profile, the attacker sends the user to a legitimate Google support page which is injected with modified content through the Chrome extension, telling the user they need to sync their profile.
When the user agrees to the sync, they unwittingly send all their local browser data, such as saved passwords, browsing history, and autofill information, to the hacker's managed profile. The hacker can then sign into this managed profile on their own device and access all that sensitive information.
The attack up to this point already provides the hacker with enough material to commit fraud and other illicit activities. However, browser syncjacking provides the hacker with the capability to go even further.
Using the teleconferencing platform Zoom as an example, SquareX explains that using the malicious Chrome extension, the attacker can send the victim to an official yet modified Zoom webpage that urges the user to install an update. However, the Zoom download that's provided is actually an executable file that installs a Chrome browser enrollment token from the hacker's Google Workspace.
After this occurs, the hacker then has access to additional capabilities and can gain access to the user's Google Drive, clipboard, emails, and more.
The browser syncjacking attack doesn't stop there. The hacker can take one further step in order to not just take over the victim's Chrome profile and Chrome browser, but also their entire device.
Through that same illicit download, such as the previously used Zoom update installer example, the attacker can inject a "registry entry to message native apps" by weaponizing Chrome’s Native Messaging protocol. By doing this, the attacker basically sets up a connection "between the malicious extension and the local binary." Basically, it creates a flow of information between the hacker's Chrome extension and your computer. Using this, the hacker can send commands to your device.
What can the hacker do from here? Pretty much anything they want. The attacker will have full access to the user's computer files and settings. They can create backdoors into the system. They can steal data such as passwords, cryptocurrency wallets, cookies, and more. In addition, they can track the user by controlling their webcam, take screenshots, record audio, and monitor everything input into the device.
As you can see, browser syncjacking is nearly completely unrecognizable as an attack to most users. For now, the most important thing you can do to protect yourself from such a cyberattack is to be aware of what you download and only install trusted Chrome extensions.
Topics Cybersecurity Google
Touring Logitech's Audio HQ
Embargo dates and Rotten Tomatoes scores: What's the relationship?
Australia is so dangerous that cartoons can't teach kids not to be afraid of spiders
Unreal images show Hurricane Irma as one of Earth's strongest storms
Here's how I feel about all this Stephen Hawking 'news' going around
Hurricane Irma: Monster storm is perfect in the most alarming ways
This is how you can Shazam on Snapchat
Uber beware: Didi
Use Gmail Filters to Automate your Inbox
Nintendo posts 'Star Fox 2' manual online
How to Get Your Significant Other Into Gaming
Uber beware: Didi
Laurene Powell Jobs' ad slams Trump on DACA with the words of Ronald Reagan
Another Star Wars director down: Colin Trevorrow out for 'Episode IX'
Best free ChatGPT courses
The secret, illicit underside of Google Drive
9 things that will 100% maybe happen in 'Game of Thrones' Season 8
Flying a plane through Hurricane Irma looks absolutely terrifying
NYT Connections Sports Edition hints and answers for February 15: Tips to solve Connections #145
Badass 'Star Wars' toys reveal new info about Supreme Leader Snoke
'Severance' Season 2 finale: Everyone in that cursed Cold Harbor paintingSaracens vs. Harlequins 2024 livestream: How to watch Premiership Rugby for freeKentucky vs. Troy 2025 livestream: How to watch March Madness for freeBest mesh WiFi deal: Save $150 on the Amazon eero Pro 6EGwyneth Paltrow dislikes intimacy coordinators. What does an intimacy coordinator think?Best tablet deal: Save $45 on the Amazon Fire Max 11Tesla tradeToday's Hurdle hints and answers for March 23, 2025Auburn vs. Creighton 2025 livestream: How to watch March Madness for freeIs 'Sing Sing' streaming? How to watch the A24 drama at home.Best mesh WiFi deal: Save $150 on the Amazon eero Pro 6EBest Echo deal: Save $20 on Amazon Echo Show 5Wisconsin vs. BYU 2025 livestream: How to watch March Madness for freeBest headphones deal: $150 off Sony WHBest Chromebook deal: Get $107 off the Asus Expertbook CX54Best cellphone deal: Save $300 on the Google Pixel 9 Pro XLNYT Strands hints, answers for March 23Best smartwatch deal: Save $80 on Garmin vívoactive 5Kentucky vs. Troy 2025 livestream: How to watch March Madness for freeNYT Connections Sports Edition hints and answers for March 21: Tips to solve Connections #179 Map shaped like a penis beguiles the internet because we are all children Female news anchor slammed for the terrible crime of wearing skinny jeans 'Stranger Pugs' may be the only thing better than 'Stranger Things' NASA just launched a probe on a mission to sample an asteroid What Wells Fargo’s $185 million settlement may mean for you High School pays beautiful tribute to cheerleader diagnosed with leukemia FBI arrests two members of hacker group Crackas With Attitude Please enjoy this footage of Kylie and Kendall Jenner stuck in an elevator Man's genius money Lady Gaga's 'Perfect Illusion' used in 'American Horror Story' promo Pokémon Go's smart Plus accessory goes on sale next Friday Genius beer mug solves the most first world TV problem Norway newspaper editor blasts Zuckerberg for censoring iconic Vietnam War photograph Calvin Harris says 'all hell broke loose' after Taylor Swift breakup. Well, duh. This is Aleppo, Mr. Gary Johnson Ariana Grande announces Dangerous Woman tour, duets with Mac Miller Graphic sexual assault photo series forces you to see the victim 13 awesome record holders to celebrate 'Guinness World Records 2017' The EpiPen company's latest critic is the guy who makes Botox Now you can honor Tupac while eating a 'California Love' burger at this pop
1.3533s , 10195.0546875 kb
Copyright © 2025 Powered by 【homo eroticism in the scarlet letter】,Inspiration Information Network