Connect with us

Technology

Malicious Google Chrome extensions hijack accounts

Published

on

Malicious Google Chrome extensions hijack accounts

NEWYou can now listen to Fox News articles!

Cybersecurity researchers have uncovered a serious threat hiding inside Google Chrome. 

Several browser extensions pretend to be helpful tools. In reality, they quietly take over user accounts. These extensions impersonate popular human resources and business platforms such as Workday, NetSuite and SAP SuccessFactors. Once installed, they can steal login data and block security controls designed to protect users.

Many people who installed them had no warning signs that anything was wrong.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Advertisement

WHY CLICKING THE WRONG COPILOT LINK COULD PUT YOUR DATA AT RISK

Cybersecurity researchers warn that fake Google Chrome extensions are silently hijacking user accounts by stealing login data and bypassing security protections. (Bildquelle/ullstein bild via Getty Images)

The fake Chrome extensions to watch out for

Security researchers from Socket’s Threat Research Team identified five malicious Chrome extensions connected to this campaign. The add-ons were marketed as productivity or security tools, but were designed to hijack accounts.

The extensions include:

  • DataByCloud Access
  • Tool Access 11
  • DataByCloud 1
  • DataByCloud 2
  • Software Access

We reached out to Google, and a spokesperson told CyberGuy that the extensions are no longer available on the Chrome Web Store. However, some are still available on third-party software download sites, which continues to pose a risk. If you see any of these names installed in your browser, remove them immediately.

Why malicious Chrome extensions look legitimate

These malicious add-ons are designed to look legitimate. They use professional names, polished dashboards and business-focused descriptions. Some claim to offer faster access to workplace tools. Others say they restrict user actions to protect company accounts. Privacy policies often promise that no personal data is collected. For people juggling daily work tasks or managing business accounts, the pitch sounds helpful rather than suspicious.

Advertisement

What these extensions actually do

After installation, the extensions operate silently in the background. They steal session cookies, which are small pieces of data that tell websites you are already logged in. When attackers get these cookies, they can access accounts without a password. At the same time, some extensions block access to security pages. Users may be unable to change passwords, disable accounts or review login history. One extension even allows criminals to insert stolen login sessions into another browser. That lets them sign in instantly as the victim.

Why malicious Chrome extensions are so dangerous

This attack goes beyond stealing credentials. It removes the ability to respond. Security teams may detect unusual activity, but cannot fix it through normal controls. Password changes fail. Account settings disappear. Two-factor authentication tools become unreachable. As a result, attackers can maintain access for long periods without being stopped.

How to check for these extensions on your computer

If you use Google Chrome, review your extensions now. The process only takes a few minutes.

  • Open Google Chrome
  • Click the three-dot menu in the top right corner
  • Select Extensions, then choose Manage Extensions
  • Review every extension listed

Look for unfamiliar names, especially those claiming to offer access to HR platforms or business tools.

WEB SKIMMING ATTACKS TARGET MAJOR PAYMENT NETWORKS

Malicious Chrome add-ons disguised as productivity tools targeted users of popular business platforms like Workday, NetSuite and SAP SuccessFactors. (Photo by S3studio/Getty Images)

Advertisement

How to remove suspicious Chrome extensions

If you find one of these extensions, remove it immediately.

  • Open Manage Extensions in Chrome
  • Find the suspicious extension
  • Click Remove
  • Confirm when prompted

Restart your browser after removal to ensure the extension is fully disabled. If Chrome sync is enabled, repeat these steps on all synced devices before turning sync back on.

What to do after removing the extension

Removal is only the first step. Change passwords for any accounts accessed while the extension was installed. Use a different browser or device if possible.

A password manager can help you create strong, unique passwords for each account and store them securely. This reduces the risk of reused passwords being exploited again.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Advertisement

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

Finally, review account activity for unfamiliar logins, locations or devices and be sure to follow the steps below to stay safe moving forward.

Ways to stay safe going forward

Simple habits can significantly reduce your risk.

1) Limit browser extensions

Only install extensions you truly need. The fewer extensions you use, the smaller your attack surface becomes.

2) Be cautious with add-ons

Avoid extensions that promise premium access or special tools for enterprise platforms. Legitimate companies rarely require browser add-ons for account access.

Advertisement

3) Check permissions carefully

Be wary of extensions that request access to cookies, browsing data or account management. These permissions can be abused to hijack sessions.

4) Review extensions regularly

Check your browser every few months and remove tools you no longer use or recognize.

WHATSAPP WEB MALWARE SPREADS BANKING TROJAN AUTOMATICALLY

Several fake browser extensions were removed from the Chrome Web Store after researchers linked them to account takeover attacks. (Photo Illustration by Serene Lee/SOPA Images/LightRocket via Getty Images)

5) Use strong antivirus software

Strong antivirus software can help detect malicious extensions, block suspicious behavior and alert you to browser-based threats before damage occurs.

Advertisement

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

6) Consider a data removal service

If your work or personal information has been exposed, a data removal service can help reduce your digital footprint by removing your details from data broker sites. This lowers the risk of follow-up scams or identity misuse.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Advertisement

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

7) Avoid third-party download sites

Do not reinstall extensions from third-party websites, even if they claim to offer the same features. These sites often host outdated or malicious versions.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

Browser extensions can be useful, but this research shows how easily they can also be abused. These fake Chrome add-ons did not rely on flashy tricks or obvious warnings. They blended in, looked professional and quietly did their damage in the background. The good news is that you do not need to be a tech expert to protect yourself. Taking a few minutes to review your extensions, remove anything unfamiliar and lock down your accounts can make a real difference. Small habits, repeated regularly, go a long way in reducing risk. If there is one takeaway here, it is this: convenience should never come at the cost of security. A clean browser and strong account protections give you back control.

How many browser extensions do you have installed right now that you have never looked at twice? Let us know by writing to us at Cyberguy.com.

Advertisement

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts  and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2026 CyberGuy.com. All rights reserved.

Advertisement
Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

Moves of the Diamond Hand is an unfinished, irresistibly weird dice-based RPG

Published

on

Moves of the Diamond Hand is an unfinished, irresistibly weird dice-based RPG

From its opening minutes, Moves of the Diamond Hand is upfront about what it offers: You’re going to have a lot of strange conversations, and you’re going to roll a lot of dice. Get on board with this proposition, and the reward is one of the most creative roleplaying games I’ve seen in years, even if its many mysteries won’t be resolved until 2027.

Moves of the Diamond Hand is an Early Access videogame available on PC, macOS, and steamOS (including the Steam Deck, where I played it) from musician and game designer Cosmo D. The game looks and feels like a 2000s-era first-person RPG or immersive sim: environments are grimy, stark, and blocky; characters’ features are stretched over smooth heads a bit too small for their faces; an eerie soundtrack pulses over all. You’ll arrive on a train and immediately meet an old mentor, disgraced by some kind of political scandal. You convey your desire to join a powerful organization called Circus X, then declare which of several wildly different paths you’ll take into its fold — you can try joining the city council, but could find equal success crafting the perfect sandwich or joining the best band.

These options help introduce the central mechanic. The game gives you one upgradeable die for each of seven stats, ranging from standard fare like Physique and Observation to the more idiosyncratic Cooking and Music. To set a challenge, it will roll a die corresponding to one of those attributes, and you’ve got to match or beat it with your own roll.

Once you emerge into the train station, the complexity quickly multiplies. There are a plethora of sub-mechanics including cooking, performing music, laundering disguises, and mixing cocktails — all of which add additional dice with unique quirks. You can selectively re-roll dice in a manner similar to Yahtzee, introducing an element of strategy within each encounter, and your final score (win or lose) is translated into experience points. The basic system was introduced in Cosmo D’s last game, Betrayal at Club Low, but in a less flexible and elegant form; Diamond Hand feels like its evolution. (Disclosure: My husband has provided outside feedback for Cosmo D’s games.)

It’s all a little intimidating at first. But the game allows you to ease into its options, which happens quickly, since you’re rolling for virtually every action and verbal exchange from making small talk to opening a door. There’s a meaningful element of chance to all this, without descending into unbounded randomness. Some rolls can be mathematically impossible to win or lose at a given skill level, but it’s possible to still damage your health or gain an unwelcome status effect with safe challenges, preventing them from becoming purely rote. You can retry most actions if you fail them, but they’ll become slightly more difficult on a second attempt, so there’s a constant balancing act of deciding when to take the initial leap. The ambient low-level risk makes even simple spaces feel substantive and engaging — it negates the common RPG urge to speed through environmental detail and flavor text while looking for the “real” parts of the game.

Advertisement

Through countless skill checks, you’ll internalize the odd logic of the game’s world. The setting, Off-Peak City, is a garish metropolis shaped by the machinations of sinister corporations, corrupt politicians, and shady operatives, but also musicians, restaurateurs, and literally and figuratively underground tailors — a neon retro-future for streetwise aesthetes. What might be niche skills in any other game prove extraordinarily powerful here. The Music stat, whose uses include sewing (machines can, among other options, be literally operated by improvisation), calming aggressive animal-human hybrids (by whistling tunes), and mixology (which can be performed “rhythmically”), is arguably the single strongest power in the game.

Don’t you hate it when laundry day sneaks up on you?
Cosmo D Studios

Circus X, you’ll soon learn, is a secretive arts institution that influences everything from politics to the sandwich supply chain — imagine the Factory crossed with the Freemasons. While pursuing membership, you’re embroiled in a local election between a scandal-plagued technocrat, a former boy-band star, and the corporate-controlled clone of a mayor from decades past. In place of a Maltese Falcon, everyone’s scheming for control of a sentient Big Mouth Billy Bass. And meddling behind the scenes is the mysterious, anarchic Diamond Hand, frequently alluded to but not explained.

Diamond Hand’s story evokes real-world parallels, but as a jumping-off point for something that’s rich and alive in its own right. In perhaps the most obvious example, a company in Off-Peak City is pumping the place full of clones, supplanting human artists with corporate-guardrailed regurgitations of old media. But rather than stop at commentary, the game walks this out to explore the idea that clones are also conscious beings who are frustrated by their creative limits and lack of autonomy, while letting human characters reflect on their own relationship with nostalgia and artistic taste.

Put this all together and you’ve got a hard-boiled sci-fi thriller involving subway busking, finding library books, stumping for politicians, harvesting lettuce, arguing about jazz, and doing laundry, infused with the lizard-brain appeal of a nonstop game of chance. It’s irresistible.

Advertisement

Most of Diamond Hand’s main quests end in roadblocks, because its Early Access build includes only the first two of six chapters, with the next scheduled for this summer and a full launch set for the spring of 2027. But even in its current state, Diamond Hand is dense and tantalizing, delivering a string of absurd premises and dry humor with a straight face. (Among many tossed-off jokes that are also actual game mechanics, local pizza-makers require everyone to bake their own pie, so if you don’t like your order, you have only yourself to blame.) You’re granted experience points for letting characters ramble through their backstories and opinions — which lands somewhere between a sly gag about RPG infodumping and a straightforwardly clever decision — but the dialogue pays off even without that prize.

And for all its dystopian elements, there’s something idealistic about a world where art, for good or ill, deeply matters. Diamond Hand may be a work in progress, but it’s a recipe for becoming obsessed with skill and perfection, chasing the world’s greatest sandwich and the string of lucky dice rolls that will get you there.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Continue Reading

Technology

Should you change your phone number after a hack?

Published

on

Should you change your phone number after a hack?

NEWYou can now listen to Fox News articles!

Getting hacked once is scary enough. But getting hacked again after changing carriers, replacing cards and trying to recover your accounts can make it feel like the criminals are always one step ahead. That is exactly what happened to Lela in Ohio, who reached out after a frightening string of account takeovers.

“All my accounts have been hacked,” Lela said. “I had my phone number transferred to another carrier, AT&T, and I’m experiencing it again. They have hacked my phone number again.” She said criminals accessed her checking accounts, credit cards and even started charging new cards before she received them.

Then she asked the question anyone in her situation would be asking: “Should I be just getting a new phone number instead of trying to recover the number I’ve had for 20 years?”

The answer is maybe, but changing your number should rarely be the first move. A new number can help in some cases. However, if hackers still control your email, bank login, recovery settings or wireless account, they may keep breaking back in.

Advertisement

SCAMMERS TARGET WIRELESS CUSTOMERS IN NEW PHONE SCHEME

A SIM swap or port-out scam can let criminals take over your phone number and intercept security codes for sensitive accounts. (Jacob Wackerhausen/Getty Images)

Sign up for my FREE CyberGuy Report

  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Why your phone number matters so much

Your phone number may feel harmless. After all, it is how friends, family, doctors and businesses reach you. But today, that number is also connected to some of your most important accounts. It may be tied to your bank accounts, credit cards, email accounts, Apple ID, Google account, medical portals, shopping accounts and password resets.

That makes it valuable to criminals. If a scammer takes control of your number, they may receive your calls and text messages. That includes security codes meant only for you. From there, they can reset passwords, break into email, access financial accounts and keep returning even after you think you fixed the problem.

What is a SIM swap or port-out scam?

A SIM swap scam happens when a criminal tricks your mobile carrier into moving your phone number to a SIM card or eSIM they control. A port-out scam happens when they move your number to another carrier.

Advertisement

Once that happens, your phone may suddenly lose service. Meanwhile, the scammer may start receiving your calls and texts. That can give them access to verification codes for email, banking, credit cards and other accounts.

In some cases, victims do not realize what happened until money disappears or accounts get locked.

Should Lela get a new phone number?

Maybe, but not immediately. If Lela gives up her long-time number too fast, she could lose access to accounts that still use that number for recovery. Even worse, if a criminal still controls the old number, they may continue receiving password reset codes for accounts tied to it. Before changing the number, she should secure the number she has and update her most important accounts.

A new number may make sense if the number keeps being targeted despite carrier protections. It may also help if hackers keep using it to reset accounts, the carrier confirms unauthorized SIM swaps or too many accounts tied to that number have already been compromised. A new number may also be worth considering if the old number is widely exposed on the dark web or data broker sites. Still, keeping the number may be safer for now if she needs it to recover critical accounts.

First, lock down the wireless account

Lela should call AT&T directly using the official number on AT&T’s website or on her bill. She should avoid numbers from texts, emails or voicemails. She should ask AT&T to check for SIM swap attempts, port-out requests, unauthorized account changes, new devices, call forwarding, number transfer activity and unknown authorized users.

Advertisement

Then she should ask AT&T to add stronger protections, including a strong account PIN, port-out freeze or number transfer lock, SIM lock if available and extra account verification. She should also remove any unknown authorized users. This makes it much harder for criminals to move her number again.

Secure your email before changing everything else

Your email is often the master key to your digital life. If a hacker controls your email, they can reset passwords for banks, credit cards, shopping accounts and social media. Before changing every password, Lela should make sure her main email account is clean and secure.

She should change her email password from a safe device, sign out of all sessions, check recovery email addresses, review recovery phone numbers and remove unknown forwarding rules. She should also review connected apps and devices and turn on stronger two-factor authentication (2FA). If email remains compromised, a hacker can keep undoing every recovery step.

Stop relying on text message codes

Text message codes are better than having no protection. However, they become risky when criminals target your phone number. For important accounts, use an authenticator app, a security key or passkeys where available.

This matters most for email, banking, credit cards, Apple ID, Google account, social media, password managers, tax accounts and government accounts. This makes your accounts much harder to break into, even if a criminal gets control of your phone number.

Advertisement

ARE BANK TEXT CODES ENOUGH TO PROTECT YOU?

Hackers can use a stolen phone number to reset passwords, break into email and access bank or credit card accounts. (Kurt “CyberGuy” Knutsson)

Change passwords from a safe device

If your phone, tablet or computer has malware, changing passwords from that device may hand the new passwords right back to the hacker. Before resetting passwords, make sure the device is safe. Update the operating system. Delete unknown apps. Run strong antivirus protection. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

Avoid links in suspicious texts or emails. Then use a password manager to create unique passwords for every important account. Never reuse old passwords after a hack. Check out the best expert-reviewed password managers of 2026 at CyberGuy.com.

Protect bank accounts and credit cards next

Since Lela said criminals charged new cards before she received them, she should treat this as possible identity theft or account takeover. She should call each bank and credit card company directly and ask for the fraud department. She should explain that her accounts, phone number or identity may have been compromised.

Advertisement

Ask each bank to cancel compromised cards, issue new card numbers, review recent activity, add verbal passwords or extra verification and remove unknown devices from online banking. She should also turn on transaction alerts and ask whether wire transfers, Zelle or other payment tools need temporary limits. Finally, she should check whether criminals opened any new accounts in her name.

Freeze your credit and file an identity theft report

If criminals have enough information to keep attacking your accounts, a credit freeze can help stop them from opening new credit in your name. Place a credit freeze with Equifax, Experian and TransUnion. You can also place a fraud alert.

Then file an identity theft report at IdentityTheft.gov. That report can help create an official recovery plan. It can also provide documentation if banks, lenders or credit bureaus need proof.

Check whether your personal information is exposed

If scammers already have your phone number, email, address, date of birth or other personal details, they may use that information to impersonate you.

A data removal service can help reduce the amount of personal information exposed on people-search sites and data broker sites. Data removal will not fix a hacked account by itself. Still, it can reduce the information scammers use to target you again. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

Advertisement

Warning signs your phone number may still be under attack

Even after you lock things down, keep watching for signs that criminals are still trying to use your number or accounts. These red flags should get your attention fast.

1) Your phone suddenly loses service

If your phone switches to SOS mode, loses service or stops receiving calls and texts, contact your carrier right away. That can be a sign of a SIM swap or port-out attempt.

2) You receive password reset codes you did not request

Random security codes can mean someone is trying to break into one of your accounts. Do not share the code with anyone. Go directly to the account website or app and change your password from a safe device.

3) Your carrier sends account change alerts

Take any wireless account alert seriously. This includes alerts about a new SIM, eSIM, device, PIN change or number transfer request.

HOW SIM SWAPPING LED TO A $1.8M CYBER FRAUD CASE

Advertisement

A new phone number may help after repeated attacks, but victims should first secure email, banking and wireless account settings. (Kurt “CyberGuy” Knutsson)

4) Your bank alerts show strange activity

Watch for small test charges, declined transactions, new payees or changes to contact information. Criminals often test an account before making bigger moves.

5) Your email shows unfamiliar logins

Check recent login activity, connected devices, forwarding rules and recovery options. If anything looks unfamiliar, remove it and change your password.

When changing your number may be the right move

If the warning signs keep showing up after you lock things down, then changing your number may be worth considering. Changing the number may help if the current number remains a constant attack path. But before switching, Lela should update her phone number on critical accounts first.

That includes email, bank accounts, credit cards, Apple ID, Google account, Social Security account, IRS account, password manager, medical portals, insurance accounts, investment accounts, utilities and shopping accounts. Then she should remove the old number from account recovery settings wherever possible.

Advertisement

Do not forget account recovery settings

A common mistake after a hack is changing the password but forgetting the recovery options. If the scammer added their email, phone number or device, they may still be able to get back in.

Check every important account for recovery phone numbers, recovery email addresses, trusted devices, backup codes, linked apps, forwarding settings, authorized users and payment methods. Remove anything unfamiliar.

Kurt’s key takeaways

A new phone number can help, but it is no magic fix. If hackers still have access to Lela’s email, bank logins, recovery settings or personal information, they may keep getting back in even with a new number. The smarter order is to lock down the wireless account first. Then secure email, stop using text codes, change passwords from a safe device and protect bank accounts. After that, freeze credit, file an identity theft report and remove exposed personal information from the web. Only then should you decide whether changing your number is necessary. Your phone number may feel personal, especially if you have had it for 20 years. But once criminals use it as a doorway into your life, the real goal is cutting off every way they can use it against you.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Have you ever had your phone number, email or bank account hacked? What was the first sign that something was wrong? Let us know by writing to us at CyberGuy.com.

Advertisement

Sign up for my FREE CyberGuy Report

  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com. All rights reserved.

Continue Reading

Technology

Nothing cancels this year’s CMF phone due to RAM prices

Published

on

Nothing cancels this year’s CMF phone due to RAM prices

Nothing’s next budget phone is the latest victim of RAMageddon. As 9to5Google reports, Nothing co-founder Akis Evangelidis announced in a post on X that a follow-up to the CMF Phone 2 Pro won’t be coming this year:

We were working on a successor but with memory prices where they are right now, we can’t build a phone that feels like a genuine step forward at a price that makes sense for CMF. As a result, we’ve decided not to launch a new CMF phone this year.

Last week, Nothing CEO and co-founder Carl Pei also said the RAM shortage has impacted the cost of the company’s mid-range phone, stating, “For Phone 4A, memory costs doubled between when we decided to build the device and when it launched. They’ve doubled again since.” According to Pei, “memory is now the most expensive component in a smartphone.” Nothing is far from the only company facing RAM pricing challenges — earlier this week, Tim Cook announced Apple will be raising prices, saying “the situation has become unsustainable.”

While there won’t be a new CMF phone this year, Evangelidis added in his post that CMF still has “several new products launching as well as some entirely new categories.” He also hinted that “the smartphone launch season at Nothing isn’t over yet.”

Continue Reading
Advertisement

Trending