The Seattle-based ICEBRG's Security Research Team discoveredfour malicious Google Chrome extensions affecting some 500,000users. These provide a substantial pool of resources to use forfraudulent purposes and financial theft.

While performing a routine investigation of anomalous traffic,ICEBRG's SRT detected a suspicious spike in outbound networktraffic from a customer workstation prompting an investigationleading to the discovery of harmful Google Chrome extensions, which could affectworkstations within major organizations, including financialinstitutions, globally.

The ICEBRG research team, Justin Warner, principal securityengineer and Mario De Tore, technical director, security researchand operations, revealed their findings in a blog. “While theseweb-based applications can enhance the user's overall experience,they also pose a threat to workstation security with the ability toinject and execute arbitrary code.” The SRT asserted to a motivatedthreat actor, this approach presents a range of opportunities, fromco-opting enterprise resources for advertising click-fraud toleveraging a user's workstation as a foothold into the enterprisenetwork.

Click fraud campaigns allow a malicious party to receiverevenue by compelling victim systems to visit advertising sitesthat pay per click. Threat actors could also use the samecapability to browse internal sites of victim networks, bypassingperimeter controls intended to defend internal assets from externalparties.