Hackers have Watch Games of Seduction Onlinediscovered a new way to remotely take control of your computer — all through the Google Chrome web browser.
A report from cybersecurity company SquareX lays out the new multifaceted cyberattack, which the firm has dubbed "browser syncjacking."
At the core of the attack is a social engineering element, as the malicious actor first must convince the user to download a Chrome extension. The Chrome extension is usually disguised as a helpful tool that can be downloaded via the official Chrome Store. It requires minimal permissions, further cementing its perceived legitimacy to the user. According to SquareX, the extension actually does usually work as advertised, in order to further disguise the source of the attack from the user.
Meanwhile, secretly in the background, the Chrome extension connects itself to a managed Google Workspace profile that the attacker has set up in advance. With the user now unknowingly signed into a managed profile, the attacker sends the user to a legitimate Google support page which is injected with modified content through the Chrome extension, telling the user they need to sync their profile.
When the user agrees to the sync, they unwittingly send all their local browser data, such as saved passwords, browsing history, and autofill information, to the hacker's managed profile. The hacker can then sign into this managed profile on their own device and access all that sensitive information.
The attack up to this point already provides the hacker with enough material to commit fraud and other illicit activities. However, browser syncjacking provides the hacker with the capability to go even further.
Using the teleconferencing platform Zoom as an example, SquareX explains that using the malicious Chrome extension, the attacker can send the victim to an official yet modified Zoom webpage that urges the user to install an update. However, the Zoom download that's provided is actually an executable file that installs a Chrome browser enrollment token from the hacker's Google Workspace.
After this occurs, the hacker then has access to additional capabilities and can gain access to the user's Google Drive, clipboard, emails, and more.
The browser syncjacking attack doesn't stop there. The hacker can take one further step in order to not just take over the victim's Chrome profile and Chrome browser, but also their entire device.
Through that same illicit download, such as the previously used Zoom update installer example, the attacker can inject a "registry entry to message native apps" by weaponizing Chrome’s Native Messaging protocol. By doing this, the attacker basically sets up a connection "between the malicious extension and the local binary." Basically, it creates a flow of information between the hacker's Chrome extension and your computer. Using this, the hacker can send commands to your device.
What can the hacker do from here? Pretty much anything they want. The attacker will have full access to the user's computer files and settings. They can create backdoors into the system. They can steal data such as passwords, cryptocurrency wallets, cookies, and more. In addition, they can track the user by controlling their webcam, take screenshots, record audio, and monitor everything input into the device.
As you can see, browser syncjacking is nearly completely unrecognizable as an attack to most users. For now, the most important thing you can do to protect yourself from such a cyberattack is to be aware of what you download and only install trusted Chrome extensions.
Topics Cybersecurity Google
Trump says he represents Pittsburgh, not Paris, but, um, well...
Introducing Thomas David, Our New Writer
“Defenestration of Prague,” a Poem by Susan Howe
Where We Live: David Graham’s Photos of American Homes
Will Oracle take over TikTok? Trump says he'll make a decision in 30 days
Watch: Orson Welles on His Friendship with Ernest Hemingway
“Defenestration of Prague,” a Poem by Susan Howe
The Paris Review Is Going to Chicago’s Printers Row Lit Fest
GPU Availability and Pricing Update: April 2022
D.H. Lawrence to Bertrand Russell: “Be a Baby, Not an Ego”
How to Get Your Significant Other Into Gaming
The Trollopian Dowagers of Beverly Hills
Dante Is Seven Hundred and Fifty—So Get a Selfie With Him
This Is the All
Houston Rockets vs. Dallas Mavericks 2025 livestream: Watch NBA online
This Doll’s Brittle, Screeching Voice Will Infect Your Soul
Notes on Becoming Dust
Charles Coypel’s Lavish, Theatrical “Don Quixote” Tapestries
The Portable Workstation: Dell XPS 13 + 32 UltraSharp 4K Monitor
Levi Strauss’s Iconic '70s Ad
Toyota forms $139 million joint venture with selfChangan Ford officially takes over Ford Mustang MachChinese battery maker Sunwoda to establish production base in Hungary · TechNodeAlibaba DAMO Academy releases videoTSMC to build first European plant with 3.5 billion euro investment in Germany · TechNodeDJI launches new drone Air 3 with dual cameras · TechNodeChinese VR company iQiyi Smart fails to pay employees amid cash flow disruption · TechNodeBYD wants to shelve its $1 billion investment in the Indian EV industry · TechNodeiFlytek introduces nextHuawei reveals HarmonyOS 4 with Live Window, similar to Apple's Dynamic Island · TechNodeHuawei cooperates with Xiaohongshu to extend terminal mobile services · TechNodeDouyin generates RMB 100 billion in local services sales in H1: report · TechNodeBMW initiates development of L3 autonomous driving in China · TechNodeHuawei’s Pangu LLM improves European weather forecasting · TechNodeTencent’s Honor of Kings leads July revenues globally with income of $115 million · TechNodePanasonic sues Xiaomi and OPPO for patent infringements · TechNodeLi Auto launches cheaper Pro version of L9 crossover · TechNodeTikTok hires retail experts from Amazon and Meta to strengthen US eFIMI releases Manta VTOL fixedNetEase Youdao unveils voice tutoring large language model · TechNode Nothing can prepare you for the sick twist in this dunk video Dude is so thirsty he actually believes that threesome invitation at Buckingham Place is real Amazon Prime's newest perk: Exclusive concerts Microsoft's Emma Watch is a game Facebook is down and everyone across the globe is freaking out Thanks to Amazon, it's time to kill your landline Want to find a date? Here's where Tinder says you should work. New Zealand's Prime Minister doesn't find John Oliver's Kiwi jokes very funny :( Gorgeous digital Mother's Day cards honor immigrant and Muslim moms Prosecco and rosé popsicles will take your summer to the next level Phone charging services are on the rise, fueled by our obsessive need to keep our batteries full People are freaking out over inevitable Taylor Swift references on Harry Styles' new album The Amazon Echo Show is real and it's got a 7 Idris Elba posts open casting call, gets way more than he bargained for Put your smartphone away, you're missing the entire history of you Weird Neil deGrasse Tyson 'pants' tweet was an accident, which makes it even stranger tbh A small robot is here to help after a mishap at a major nuclear waste site Who needs T You won't believe how fast this Microsoft plug Not even 'American Idol' fans want 'American Idol' to come back
3.1747s , 10137.3203125 kb
Copyright © 2025 Powered by 【Watch Games of Seduction Online】,Miracle Information Network