Unwelcome Visitors, Ideological Warfare, Caught Bang to Rights, Not Mischief: Malice, Dos and Don'ts, and Return of the mac Threat. It's CISO Intelligence for Friday, 11th July 2025.
This is not "Old Time Rock and Roll," belief is a powerful instrument, a very British heist: at least they didn't blow the doors off, invisible cloaking is a thing, new rules, and an old dog with new tricks.
Table of Contents
- Risky Business: When Extensions Hitch a Ride on Your Browser
- Pay2Key Strikes Back: Iranian Cyber Rascals Loot the West Again
- Lock, Stock, and Two Smoking Keyboards
- TapTrap: The Animation that Taps Away Your Privacy
- Zipping Up Your Passwords: CJIS Compliance Decoded
- macOS Malware: When Termius Became a Trojan Rider
Risky Business: When Extensions Hitch a Ride on Your Browser
When browser extensions moonlight as web scrapers, it’s not just the cookies that crumble.
What You Need to Know
Browser extensions are the latest unwitting accomplices in cyber malfeasance, with millions of users unknowingly turning their web browsers into proxies for a sophisticated web scraping botnet. A library known as Mellowtel, embedded within many extensions, is behind this stealthy operation. The exploitation has prompted stringent actions from browser developers, although the risk remains significant due to inadequate measures across numerous extensions. Executive management is advised to evaluate and enhance current cyber defense strategies, focusing on potential vulnerabilities within browser extensions.
CISO focus: Application Security, Data Privacy, User Awareness
Sentiment: Negative
Time to Impact: Immediate
Here’s How Extensions Step Into the Cyber Underworld
Millions of internet users face a silent menace lurking in their web browsers: rogue browser extensions. Recent investigations revealed a sophisticated exploitation involving 245 extensions across major platforms like Chrome, Edge, and Firefox. These extensions, housing a harmful library named Mellowtel, turn browsers into unexpected proxies for a web scraping botnet, scraping your browsing sessions when not in use.
Behind the Curtains: The Mellowtel Masterpiece
Mellowtel artfully waits for moments of user inactivity. Then, with the stealth of a shadowy cat burglar, it deactivates page security features and clandestinely loads a remote site in a hidden iframe. This seemingly innocuous action sends your browsing data into the netherworld of unwanted data harvesting. Researchers at SecureAnnex were the first to expose this code embedded deftly within a sea of common extensions.
A Corporate Crackdown: Proactive Measures
Faced with this revelation, browser developers have started physical mitigation through the removal of malicious elements from extensions. As of the current stance, 12 of the impacted 45 Chrome extensions, 8 of the 129 influenced Edge extensions, and 2 of the 69 affected Firefox extensions have been purged of Mellowtel. However, this partial compliance underscores a mere scratch on the surface of a larger problem.
Fighting Back: Lessons and Actions
While developers are gradually pulling the brakes on this invasive technology, organizational defenses cannot rest easy. An immediate revaluation of extension management and privacy protocols is essential. Users must scrutinize the permissions required by extensions, and organizations should limit extension usage only to trusted publishers.
- Adopt vetted cybersecurity frameworks focusing on the scrutiny of third-party applications.
- Empower user education programs to spotlight the dangers of browser extensions.
- Deploy more robust threat detection tools to catch unusual browser activities.
The Hidden Fallout: Why This Matters
The repercussions of such vulnerabilities extend far beyond personal data breaches. For enterprises, sensitive proprietary information and operational data sits in the crosshairs of these stealthy browsers-turned-botnets. Moreover, the broader ecosystem suffers as legitimate web analytics tools can yield skewed data upon interference by botnets, a truly proverbial egg on the face moment for data reliability.
In an era racing towards increased digitization, trust in digital ecosystems remains vulnerable. As this incident underscores, the security of browser extensions is more than a footnote—it is a critical facet in the larger cybersecurity jigsaw puzzle.
Vendor Diligence Questions
- How thoroughly does your product vet third-party libraries or components integrated within applications?
- What measures are in place to monitor the extensions available through your product for potential malicious activities?
- Can you provide documentation or audit results for recent security assessments conducted on your application ecosystems?
Action Plan
- Conduct an immediate audit of all browser extensions currently used in the organization.
- Increase user awareness sessions focusing on understanding extension risks and responsible installation practices.
- Collaborate with IT security teams to regularly update extension usage policies and continuously monitor compliance.
- Engage vendors to ensure their products and extensions meet high security and privacy standards.
Source: Risky Business
More Information: SecureAnnex Blog
