Security Alert: The browser extension released by Cyberhaven has been implanted with malicious code, and multiple extensions have been attacked

ChainCatcher message, AabyssTeam founder issued a security warning on X, stating that Cyberhaven security company was attacked by phishing emails, resulting in the browser plugin they released being implanted with malicious code, attempting to read the uploaded users' browser cookies and passwords. Subsequent code analysis revealed that multiple browser plugins were attacked, including Proxy SwitchyOmega (V3), affecting five hundred thousand users in the Google Store, which is currently under scrutiny.

The founder of Slow Mist, Yu Xian, forwarded the warning and stated that this type of attack uses an OAuth2 attack chain. After obtaining the "extension publishing rights" of the developer of the "target browser extension," they publish an updated plugin extension with a backdoor. Each time the browser is launched or the extension is reopened, it may automatically trigger the update, making the backdoor implantation difficult to detect. He reminds wallet extension developers not to be careless.