The install has remained undetected by most AV engines according to the report. Credit: Shutterstock

Malicious web extensions have impacted more than 300,000 users of Google Chrome and Microsoft Edge through malware installation, according to a new research paper.

Threat actors looking to install malware onto a user’s computer have exploited browser extensions to run harmful scripts intended to deliver adware and steal private data, according to research by cybersecurity company ReasonLabs.

Go deeper with GlobalData

Data Insights

The gold standard of business intelligence.

Find out more

Related Company Profiles

View all

The latest paper points to consistent reports of unwanted browser extensions appearing on Microsoft and Google search browsers without manual installation or the ability to remove the extension. The result is that malicious scripts are running on users’ devices to benefit cyber-criminals and hijack computers.

Fake websites have been created to trick users into installing a programme which infects their devices and enabling a browser extension which cannot be removed.

Websites such as YouTube, VLC media player, and password manager KeePass, have been faked to persuade users to download the malware.

The report states that: “At the time of writing, most AV engines do not detect the installer and the extensions. Countless users across the web are complaining about an extension that they cannot get rid of […] they don’t know how it appeared, and it keeps returning after attempts to remove it.”

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData
Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

ReasonLabs has alerted Google and Microsoft who say they are taking appropriate measures.

Cyberattacks are becoming increasingly more sophisticated, making it almost impossible to identify a real website from an impersonation in some cases.

ReasonLabs warns: “The responsibility must not fall solely on the end user. Antivirus providers and makers of endpoint protection software must prioritise these relatively new threats to safeguard their users.”