The chrome extension of Mega.nz file hosting and sharing service has been compromised by an unknown attacker who uploaded a malicious version of MEGA’s Chrome extension, version 3.39.4, to the Google Chrome web store.
The attack happened on 4th September, when MEGA’s Chrome extension was updated to version 3.39.4 on the Google Chrome Web Store. The malicious version is capable of stealing users’ credentials for popular websites like Amazon, Microsoft, Github, and Google, as well as private keys for users’ cryptocurrency wallets.
Upon installation or auto-update, Mega would ask users to allow additional permission that would allow it to steal credentials from sites like Amazon, Github, and Google, along with online wallets such as MyEtherWallet and MyMonero.
If users had accepted the additional permissions or had auto-update enabled the malicious version will get downloaded thus compromising the entire personal information of the users.
According to the researchers, only those users are affected who already had the MEGA Chrome extension installed at the time of the incident, auto update enabled, and they accepted the additional permission, or if users had freshly installed version 3.39.4.
How to stay safe?
Users who had installed the malicious extension should uninstall the MEGA extension version 3.39.4 asap, and change passwords for all your accounts, especially for those you may have used while having the malicious extension.
Comments from Ankush Johar, Director at Infosec Ventures – an organisation that provides complete infrastructure security solutions for commercial and government clients of all sizes:
This is not the first time that hackers have replaced the code of legitimate apps via hacking the vendor itself. Even Microsoft’s CCleaner was a victim of a similar attack same time last year.
What was much devious this time was chrome updates happen automatically although if the update revises the permissions like in this case, the user is prompted to agree to the new permissions.
Chrome plugins have become an extremely common attack vector and users are suggested to stay vigilant while downloading extensions. Many malware nowadays, inject malicious chrome plugins to spread ads and steal user data hence users are advised to regularly check the extensions installed in their browser by going to Settings (3 dots on top right corner) -> More Tools -> Extension
For Firefox users can go to “Tools” -> “Add-ons”.
Here users are suggested to review the add-ons and their permissions and make sure all unfamiliar add-ons are removed.