Free Email Security Risk Assessment

See if your organization’s current email security stops the latest BEC, malicious attachments, files, and other exploits. Installs in minutes - with no change to current infrastructure - and you'll get personalized insights showing attacks your current email security missed.

Get it Now

It’s Time to Get Started with SlashNext

Learn how to leverage the industry’s best zero-hour phishing protection and IR solutions in your environment.

request a demo

Rogue and Malicious Software, Apps, and Extensions

There is a lot at stake with all types of phishing, but malicious browser extensions can be particularly sophisticated. Google runs security checks on Chrome extensions before they are available in the store, but cybercriminals know this, and by design, these browser extensions have legitimate functionalities. They are capable of updating or downloading JavaScript on the fly and once installed; the malicious script is downloaded from the web. Using a runtime code, once the browser is closed, it goes away, but when you launch the browser, it’s active, because the code is living inside the browser memory with JavaScript. JavaScript is the most common thing you can find inside a browser, so there’s no way you can distinguish the malicious JavaScript that is scraping data from JavaScript that’s being rendered by a legitimate page.

Now we see more phishing attempts that can bypass two-factor authentication (2FA) or multi-factor authentication, with Man-in-the- Browser attacks. Many with 2FA believe they’re protected from phishing because the birth of 2FA grew from the knowledge that anti-phishing defense systems were no longer working. Users think it’s ok to use extensions that make their life easier, like logging into email faster or using a PDF Converter. These extensions have legitimate functionality, but they have a side business, and that’s the reason why they are free. Their exact functionality is the Man-in-the-Middle that is scraping and selling their data.

At SlashNext, we see malicious browser extensions that merely wait for the 2FA to complete. A browser extension offers bad actors the perfect workaround for organizations that rely heavily on 2FA. By design, once a browser extension is installed, it has access to the complete canvas of the browser. Once logged in, they hijack the session and capture whatever is being rendered on the computer screen. These extensions have the full power to do whatever the user is doing and seeing whatever is within that browser window. For example, a user logs into a Service Now Management Portal, once 2FA is complete, the browser extension starts collecting data—leaving the organization’s cloud infrastructure wholly open and vulnerable. With cybercriminals waiting for the user to log in legitimately before they start exfiltrating data from the browser, 2FA or multi-factor authentication ceases to be a viable security option to protect organizations.