Cybersecurity Startup Cyberhaven Hit by Hackers by Chrome Extension

 

Cyberhaven, a startup specializing in data-loss prevention, recently reported that its Chrome browser extension was hijacked by hackers. The malicious update, version 24.10.4, was designed to pilfer sensitive user information such as passwords and session tokens. This incident was part of a broader campaign aimed at Chrome extension developers, according to Cyberhaven's statement to TechCrunch.

The breach occurred on Christmas Day when attackers managed to compromise a company account, which was then used to push the harmful update to the Chrome Web Store. 

Cyberhaven's internal security team identified the malicious package the following day, December 26, and swiftly removed it, although it had been active for several hours. 

For users who had installed the compromised extension, there's a risk that their sensitive data, including authentication details, could have been exfiltrated to an attacker-controlled domain. Cyberhaven has advised affected users to update to version 24.10.5 or newer, and to change all passwords and API tokens that do not use advanced security measures like FIDO2.

The company hasn't clarified whether credentials for other accounts stored in users' Chrome browsers should also be changed. Cyberhaven's spokesperson provided no further details when questioned by TechCrunch. The attack was facilitated through the single admin account used for managing the extension's presence on the Google Chrome Store, but how this account was compromised remains undisclosed.

This incident underscores the ongoing threats to software supply chains, where even security-focused companies are not immune to sophisticated cyberattacks. Cyberhaven is now reviewing its security protocols to prevent future incidents.