A massive surveillance campaign has exposed how browser add-ons can transform a helpful tool into an unwitting data-harvesting platform. Cybersecurity researchers uncovered at least 111 malicious Chrome extensions—downloaded more than 32 million times—capable of capturing keystrokes, taking screenshots, and stealing login credentials. Google has removed the flagged extensions, but the incident reveals a persistent weak spot in how users trust browser customization.
What happened
- 32+ million downloads of extensions later flagged as malicious
- Awake Security identified at least 111 fake or fraudulent extensions
- Capabilities included screenshot capture, credential theft, and keystroke logging
- Sectors affected: financial services, healthcare, and government organizations
- All flagged extensions have been removed by Google
- The extensions traced back to infrastructure owned by Galcomm, an Israeli web hosting firm
How Browser Extensions Became a Spy Platform
Extensions extend what browsers can do. Users install them to block ads, save bookmarks, or stream content across devices. The catch: extensions request broad permissions to function—permissions that can include reading everything you type, capturing your screen, and accessing site data. Most users grant these permissions without reading the fine print.
Awake Security researchers found that the malicious extensions in this campaign exploited that trust. They posed as legitimate tools while quietly harvesting data from anyone who installed them. The researchers linked all flagged extensions to infrastructure managed by Galcomm, an Israeli company that claims to oversee roughly 250,000 domains. More than 15,000 of those domains showed signs of malicious or suspicious activity, according to the report.
Galcomm's owner, Moshe Fogel, denied any involvement in malicious activity when reached by Reuters. Google did not comment on Galcomm's role but confirmed removing the flagged extensions and said it uses such incidents to improve its automated detection systems.
Browser extensions have been tied to cyber attacks before, including ones that came to light in early 2020. The pattern is consistent: developers create genuinely useful-looking tools, build a user base, then either sell the extensions to malicious actors or deliberately insert surveillance code.
Why This Matters
Browser extensions represent one of the most overlooked attack surfaces in everyday computing. Most users think of antivirus software or strong passwords as their primary defense, but an unchecked browser add-on can bypass both. Once installed with broad permissions, a malicious extension operates at the core of your browsing session, reading data that flows through every site you visit.
The Awake campaign stands out for its scale rather than its novelty. The techniques used—keystroke logging, screenshot capture, credential theft—are standard fare in the attacker's toolkit. What changed here was the convergence on a single registrar's infrastructure and the volume of downloads. This suggests the actors behind it were less interested in targeted attacks and more interested in bulk data collection, likely for resale on underground markets.
Google's response is instructive but incomplete. Removing flagged extensions and improving pattern detection helps, but the company relies heavily on automated scans and user reports. A sophisticated developer can pass initial review, build a user base, then switch on malicious functionality later. The current review process does not catch that pivot.
Who Should Care
| User Profile | Risk Level | Why |
|---|---|---|
| Business users handling sensitive data | High | Credentials and internal communications exposed |
| Healthcare and government workers | High | Regulatory data and classified information at risk |
| General consumers with online banking | Medium | Financial login credentials may be compromised |
| Casual browsers (news, shopping only) | Low-Medium | Personal data and purchase history vulnerable |
What You Can Do
Audit your installed extensions today. Chrome's settings menu lets you review every add-on and the permissions it requests. Remove anything you do not actively use. For extensions you keep, ask whether the permissions make sense—a simple theme extension has no business reading your browsing history or capturing keystrokes.
Stick to extensions with clear, verified developer identities. Avoid those with minimal review counts or generic descriptions. When an update changes an extension's permissions, treat it as a red flag until you understand why.
What to Watch Next
Google says it is improving its detection systems and marking known malicious patterns to prevent flagged developers from returning under new names. Whether that closes the gap remains to be seen. The company faces a structural challenge: making it easy to publish extensions while keeping malicious ones out.
Browser extensions are software, and software can be weaponized. Treat them accordingly.
Key takeaways
- Browser extensions with broad permissions can harvest credentials, screenshots, and keystrokes without obvious signs
- More than 32 million downloads of flagged extensions show how easily users can be exposed through trusted add-ons
- Google removed the malicious extensions but relies on detection methods that sophisticated actors can circumvent
- Regularly audit installed extensions and remove any that request permissions unrelated to their function
- Maintain skepticism toward extensions from unknown developers or those that change permissions after installation
Frequently asked questions
How do malicious browser extensions steal data?
They request broad permissions during installation—such as access to read your browsing activity, capture keystrokes, or take screenshots—and then use that access to silently collect and transmit data to remote servers.
How can I check which Chrome extensions I have installed?
Open Chrome, go to Settings, click "Extensions" in the left panel, and review the list. Each extension shows its permissions; remove anything you do not recognize or no longer use.
Did Google take action against the extensions mentioned in the report?
Yes. Google confirmed that all extensions flagged by Awake Security have been removed from the Chrome Web Store and that the company uses such incidents to improve its detection systems.
What should I do if one of my extensions was removed?
If an extension disappeared from your browser, it was likely flagged for policy violations. Do not reinstall it from another source. Look for alternative extensions from verified, well-established developers.
Are browser extensions from large companies safe to use?
Not automatically. Extensions from any developer can become malicious if sold to bad actors or if the developer changes their code. All extensions should be evaluated based on the permissions they request and their track record, regardless of the source.