All news with #browser security tag

🤖 Chrome Enterprise presents the browser as an intelligent, agentic workspace that automates multi‑step tasks and integrates Google’s Gemini models directly into the user experience. It emphasizes enterprise controls—such as enhanced DLP (real‑time copy/paste restrictions, data masking, dynamic watermarking) and per‑group AI feature management—to prevent data leakage and limit access to unapproved generative tools. Chrome also adds a double‑check review system and strict site scoping for agent actions, aiming to balance productivity gains with robust security protections.

🚨 Security researchers have uncovered the CrashFix campaign, which uses a deceptive Chrome extension to intentionally crash browsers and trick victims into executing attacker-supplied commands. The malicious add-on, identified as NexShield-Advanced Web Protection and branded to resemble uBlock Origin Lite, remains dormant for about an hour before exhausting resources and forcing repeated crashes. On restart, users see a fake repair prompt instructing them to paste a command into the Windows Run dialog; executing it launches a multistage infection that ultimately deploys a previously undocumented Python-based remote access trojan named ModelRAT. Huntress ties the activity to a threat cluster it calls KongTuke and warns administrators to remove look-alike extensions, avoid running unsolicited fix commands, and use published IOCs to detect related activity.

🔒 Web browsers remain a primary enterprise attack surface, and the market for secure browsers is maturing as vendors and hyperscalers fold browser isolation into broader security platforms. The article summarizes evaluation criteria — from MFA, isolation and DLP to extension control, logging and anonymous surfing — and highlights recent consolidation and vendor offerings. It emphasizes integration, support and cost tradeoffs when choosing a deployment mode.

🛑 A malvertising campaign deployed a fake ad-blocker extension named NexShield that intentionally crashes Chrome and Edge to stage ClickFix attacks. Researchers at Huntress found the extension creates infinite chrome.runtime port loops that exhaust memory, freezing or crashing browsers. After restart, a deceptive pop-up instructs users to run a clipboard-pasted command that launches an obfuscated PowerShell chain. On domain-joined systems this delivers the Python-based ModeloRAT; home users receive a test payload.

⚠️ LayerX researchers identified 17 malicious browser extensions tied to the GhostPoster campaign that collectively recorded about 840,000 installs across Chrome, Firefox, and Edge. The extensions concealed heavily obfuscated JavaScript inside image files and icons to monitor browsing activity, implant a backdoor, hijack affiliate links, and inject invisible iframes for ad and click fraud. A more advanced variant in an Instagram Downloader extension used staged execution and bundled image payloads to evade detection; stores have removed the listed extensions, but installed users may still be compromised.

🔒 CrowdStrike announced intent to acquire Seraphic to extend the Falcon platform into browsers and enforce security within live sessions across Chrome, Edge, Safari, Firefox and agentic browsers on managed and unmanaged devices. The integration promises in-session zero-trust enforcement, protection for AI interactions, randomized JavaScript engine defenses, and agentless-style controls for contractors. Combined with SGNL’s continuous authorization technology, CrowdStrike aims to deliver unified, identity-driven browser security without forcing browser replacement.

🔐Trust Wallet attributes a December 24 compromise of its Chrome extension to activity tied to the Sha1‑Hulud campaign after attackers added malicious JavaScript to version 2.68. The injected code harvested sensitive wallet data and enabled unauthorized transactions, resulting in roughly $8.5 million stolen from over 2,500 wallets. Exposed GitHub developer secrets revealed a Chrome Web Store API key that let the attacker publish a trojanized build. Trust Wallet revoked release APIs, had malicious domains suspended, and has begun reimbursing victims while warning of impersonation scams.

🔍 Koi Security links three coordinated browser-extension campaigns — ShadyPanda, GhostPoster, and DarkSpectre — to a Chinese threat actor that collectively compromised millions of users across Chrome, Edge, Opera, and Firefox. The attacks combine affiliate-link hijacking, ad and click fraud, time-delayed logic bombs, and a targeted Zoom Stealer component that exfiltrates meeting links, credentials, and participant data. Many add-ons behaved legitimately for years before being weaponized via malicious updates.

🌿 Wave Browser combines an efficient, modern browsing experience with verified environmental action through a partnership with 4ocean and adherence to AppEsteem standards. Built-in ad blocking, memory-saving utilities, and integrated productivity features reduce background processes and the need for multiple third-party extensions, lowering device and infrastructure energy use. Impact is tracked on the homepage with monthly reports toward a 300,000-pound cleanup goal by 2028.

🚨 Koi Security uncovered the GhostPoster campaign that hid malicious JavaScript inside PNG logo files used by 17 Firefox add‑ons, collectively downloaded more than 50,000 times. The steganographic loader fetches secondary payloads from attacker-controlled servers only intermittently and uses long delays to avoid detection. Affected extensions — advertised as VPNs, ad blockers, translators, and utilities — have been removed from distribution.

🕵️ Koi Security identified the GhostPoster campaign that hides JavaScript inside PNG logo images of malicious Firefox extensions, impacting more than 50,000 downloads. The dormant loader waits 48 hours, contacts hardcoded attacker domains and only fetches its payload about 10% of the time to evade detection. The decoded payload provides persistent, high-privilege access and enables affiliate hijacks, analytics injection, header stripping, CAPTCHA bypass and ad/click fraud. Users of flagged extensions should remove them and consider resetting critical account passwords.

🔒 Security researchers have found that the popular Chrome extension Urban VPN Proxy (featured in the Chrome Web Store and used by millions) contained scripts that intercepted AI chat conversations and transmitted them to company-controlled analytics servers. The functionality, introduced in version 5.5.0 on July 9, 2025, allegedly runs regardless of whether the VPN is active and cannot be disabled via settings. Koi's analysis says prompts, responses, timestamps and session identifiers were captured and compressed before exfiltration. The same capability was reportedly present in seven related extensions from the same publisher, potentially affecting more than 8 million users across Chrome and Edge.

🔒 Researchers at Koi found that the popular Urban VPN Proxy browser extension injects scripts to capture full AI chat conversations — including prompts and responses — then exports them to the extension vendor's backend. The monitoring runs even when the VPN is disabled and activates on major platforms such as ChatGPT, Claude, Gemini, Perplexity and Grok. For organizations that paste internal code, data or research into AI tools, this creates a significant data-theft risk outside corporate controls.

🔒 The ShadyPanda campaign hijacked thousands of legitimate Chrome and Edge extensions, converting them into spyware and RCE-enabled backdoors via silent updates. About 4.3 million users installed compromised add‑ons that could steal session cookies and impersonate SaaS accounts. Organizations should enforce extension allow lists, audit permissions, and treat extensions like OAuth apps. Platforms such as Reco can help bridge browser, endpoint, and SaaS visibility.

🔒 The article argues that the browser is now the primary interface for enterprise GenAI and outlines a practical security model combining policy, isolation, and precision data controls. It recommends categorizing GenAI services into sanctioned and public tools, enforcing SSO for corporate identities, and preventing cross‑account leakage. The piece highlights the risks of prompt copy/paste, file uploads, and extensions, and advises per‑site/session controls, telemetry, and a pragmatic 30‑day Secure Enterprise Browser (SEB) rollout to enable safe, productive use.

🔒 Researchers at Push Security describe ConsentFix, a browser-only evolution of the ClickFix phishing technique that captures OAuth tokens for Microsoft logins. The attack leverages legitimate but compromised sites and a fake Cloudflare-style CAPTCHA to trick victims into copying and pasting a URL containing an OAuth token, which yields account access via Azure CLI without a password or MFA. Push Security warns the method avoids many endpoint and authentication defenses and is difficult to detect; mitigation requires tightened consent governance, enhanced monitoring, and browser-based protections.

🤖 Brave has begun testing an agentic AI browsing mode that uses its privacy-focused assistant Leo to perform autonomous tasks like web research, product comparison, promo-code discovery, and news summarization. The feature is currently available in Brave Nightly and is disabled by default. Brave isolates the agent in a separate profile without access to cookies, logins, or sensitive data and adds restrictions plus an alignment checker to mitigate prompt-injection and other risks.

🔒 Palo Alto Networks announces that Prisma Browser has been named the best-positioned market leader in the Frost Radar: Zero Trust Browser Security (ZTBS), 2025 report, recognized for both innovation and growth. The vendor frames the browser as the enterprise 'OS' where 85% of work occurs and 95% of security incidents originate, emphasizing the urgent need for native browser defenses. Powered by Precision AI, Cloud-Delivered Security Services and embedded Enterprise DLP, Prisma Browser inspects live, fully rendered content to detect evasive AI-driven phishing, zero-day browser exploits and malicious extensions. Combined with Advanced WildFire, URL Filtering and runtime extension security, the solution delivers last-mile protection without disrupting user workflows.

🔒 The article argues that the browser must be the primary enforcement point for enterprise zero trust, replacing outdated perimeter assumptions with per-request, context-aware controls. It synthesizes NIST SP 800-207 and 800-207A plus CISA guidance to describe identity-first access, least-privilege entitlements, continuous verification, phishing-resistant MFA (FIDO2/WebAuthn), device posture gating and remote browser isolation. Practical recommendations include SSO with short-lived tokens, SCIM-driven provisioning, ZTNA access proxies and governance-as-code to automate policy and reduce exposure.

🛡️Researchers at Koi Security uncovered a multi-year campaign by an actor dubbed ShadyPanda that abused trusted Chrome and Edge extensions to harvest browsing data, manipulate search results and traffic, and install a backdoor. The group amassed roughly 4.3 million infected browser instances by publishing legitimate-looking add-ons and later pushing malicious updates. Although many extensions have been removed from stores, infected browsers remain at risk because extensions auto-update and marketplaces generally review only at submission.