Act
active
Chrome/Edge extensions caught stealing crypto and browser data
- Engineer — Plan: Audit installed Chrome/Edge extensions across your managed fleet and enforce an allowlist policy; no CISA KEV or active enterprise exploitation signal, but browser extension supply-chain risk is real for developer workstations.
- SOC/IR — Act: Hunt for suspicious extension IDs from the reported malicious set in browser inventory logs and EDR telemetry; also look for ClickFix lure behavior (fake captcha/update prompts triggering clipboard/PowerShell execution) as a detection pattern since this reporting date.
- Leader — Plan: Browser extension governance is a gap in most enterprise policies — use this as a prompt to task the team with drafting an approved-extension policy before the next audit cycle.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.