Link: Malware through Hijacked Chrome Extensions

Wordfence is providing another excellent public service announcement, this time regarding hijacked extensions.

While the method of attack is interesting, there are a number of important actions recommended in the post. I’d like to call your attention to a few:

1. Don’t trust links in e-mails. As we become used to search bars being combined with the address bar, we get careless about looking at the actual URL. Learn enough about URLs to know which site you’re on and whether or not the connection is secure. When you find a link in an e-mail, you want to determine what the actual URL is. Even if there’s a URL that you can read, it can be compromised. Let me show you with a simple (and safe) example: https://hneufeld.com. If you look at the URL, you see the “https” which indicates it’s going to be an encrypted connection. It would be “http” otherwise. The domain is hneufeld.com, which is this very domain! But if you click, you’ll go to another web site of mine, mybibleversion.com. So don’t trust links. You can verify by right clicking, choosing “Copy link location” (or equivalent), and then pasting that into your address bar.
2. Don’t download attachments unless you’re sure. Make sure you know the sender. Don’t just see their name at the top. Look at the person and the actual e-mail. Make sure this is something you’d expect to get from the person sending that e-mail. If in doubt ask. If you’re one of my clients, call or text, and I’ll take a look for you.
3. Don’t have any extra extensions on your browser. There are many reasons to do this, including the fact that extra toolbars (and other extensions) slow your browser down. Most importantly, however, the more different stuff you have there, the more opportunities there are for problems.
4. Don’t install software on your computer unless you know you want it and will use it. If you install something as a trial and then decide you don’t want it, uninstall it.
5. Use secure passwords. Figure out how to remember or safely store these. This is a subject in itself.
6. If you note any unusual activity on your computer, such as unexpected popups, scan the computer with your antivirus.

Read the linked article. They discuss more details, and I’m only touching on the high points. But this covers many ways in which computers are compromised.