Technology
Dangerous Chrome extensions mimic password managers
Google Chrome privacy tricks
Kurt the CyberGuy explains how to increase your security and privacy through Google Chrome on your devices when browsing the web.
Chrome extensions are incredibly useful, whether you want to block ads, track the best deals or enhance your browsing experience. They can be downloaded from the Chrome Web Store, which functions like the Play Store but for extensions. However, extensions are easier to mimic and turn into malicious software compared to apps.
As we just reported, over 3.2 million users were victimized by a security breach tied to 16 malicious browser extensions, highlighting how attackers exploit tools that seem legitimate to spread malware or steal sensitive data.
Now, security researchers have discovered a polymorphic attack that allows malicious Chrome extensions to transform into other browser extensions, including password managers, crypto wallets and banking apps, to steal sensitive information.
Keep reading to learn how this attack works and how to protect yourself from it.
STAY PROTECTED & INFORMED! GET SECURITY ALERTS & EXPERT TECH TIPS – SIGN UP FOR KURT’S THE CYBERGUY REPORT NOW
Chrome browser on smartphone (Kurt “CyberGuy” Knutsson)
How the malicious polymorphic attack works
Security researchers at SquareX Labs have found a new attack that lets malicious Chrome extensions disguise themselves as legitimate ones, like password managers, crypto wallets and banking apps, to steal sensitive information. This “polymorphic” attack takes advantage of Chrome’s extension system to trick users while staying under the radar.
The attack starts with hackers uploading what looks like a harmless extension to the Chrome Web Store. It might even have real features, like an AI-powered marketing tool, to convince users to install and pin it to their browser.
Once installed, the malicious extension scans the victim’s browser for other extensions. It can do this in two ways. If it has permission to use the “chrome.management” API, it grabs a list of installed extensions directly. If not, it injects code into web pages to check for unique files or resources tied to certain extensions.
If it finds a targeted extension, like 1Password, the malicious extension reports back to an attacker-controlled server. The attacker then tells it to impersonate the real extension by disabling it if permissions allow, changing its name and icon and displaying a fake login popup that looks just like the real thing.
Fake extension page (SquareX)
THE HIDDEN COSTS OF FREE APPS: YOUR PERSONAL INFORMATION
Social engineering makes things worse
To steal user credentials, the malicious extension triggers a fake “Session Expired” prompt when the victim tries to log in to a website. This tricks them into thinking they need to reenter their credentials for their password manager or banking app. When they do, the stolen data is sent straight to the attackers.
After collecting the credentials, the extension switches back to its original form. It restores the legitimate extension, making everything look normal so the victim doesn’t suspect anything. This shows just how dangerous malicious Chrome extensions can be and why stronger security measures are needed to protect users.
We reached out to Google, and a spokesperson told CyberGuy, “We appreciate the work of the research community and we’ve received the report. We are constantly investing in ways to improve the security of the Chrome Web Store, and we take appropriate action when we learn of emerging threats.”
WHAT IS ARTIFICIAL INTELLIGENCE (AI)?
Google Chrome extension on a laptop (Kurt “CyberGuy” Knutsson)
OUTSMART HACKERS WHO ARE OUT TO STEAL YOUR IDENTITY
5 ways you can protect your personal data
Here are five ways to safeguard your sensitive information and maintain your online privacy.
1. Keep your browser and extensions up to date: Outdated software is a goldmine for cybercriminals. Bugs or security gaps in old versions of your browser or extensions can be exploited to inject malicious code, steal data or take control of your system. Updates patch these vulnerabilities, making them a critical line of defense. Turn on automatic updates for your browser (e.g., Chrome, Firefox, Edge) so you’re always running the latest version without thinking about it. See my guide on keeping your devices and apps updated for more information.
2. Install extensions only from trusted sources: Official browser stores like the Chrome Web Store or Firefox Add-ons have rules and scans to catch bad actors, but they’re not perfect. Extensions from random websites or third-party downloads are far more likely to hide malware or spyware. Stick to the official store for your browser; don’t download extensions from sketchy links.
3. Have strong antivirus software: The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.
4. Update your passwords: Change passwords for any accounts that may have been affected by the extension and use unique, strong passwords for each account. Consider using a password manager. This can help you generate and store strong, unique passwords for all your accounts. Get more details about my best expert-reviewed password managers of 2025 here.
5. Invest in personal data removal services: If your personal data gets stolen by the extension, it’s crucial to act quickly to reduce your risk of identity theft and scams. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services here.
MASSIVE SECURITY FLAW PUTS MOST POPULAR BROWSERS AT RISK ON MAC
Kurt’s key takeaway
The malicious extension highlights that Google isn’t doing enough to keep malware off its platform. Security researchers pointed out that the Chrome Web Store lacks protections against these types of attacks, such as blocking sudden changes to an extension’s icon or HTML, or at least alerting users when such changes occur. The problem isn’t limited to the Chrome Web Store. The Play Store also hosts malicious apps from time to time, affecting millions of users. Google needs to step up its security efforts and put user privacy front and center.
Do you trust Google to keep malicious apps and extensions off its platforms? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels:
Answers to the most-asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
T-Mobile is letting some legacy plan customers know that a price increase is coming, 9to5Google reports. Many Reddit users on r/tmobile said the carrier sent them text messages that their plans will raise by $5 per month per line starting on April 2nd.
In an internal memo obtained by CNET, T-Mobile consumer group president Jon Freier says the price increase addresses “rising costs” for the company. The memo noted that affected customers would be notified by the end of the day today.
CNET says it’s unclear which legacy plans will be affected but notes that Go5G, Go5G Plus, and Go5G Next subscribers won’t be subject to the price hikes. T-Mobile had already increased the rates of some of these older plans by $2 to $5 last year, and Freier apparently notes in the memo that “no line that received a prior increase will receive an additional adjustment as part of this initiative.”
“While most customers are not included, we’re wrapping up the price adjustments that began last year in response to rising costs,” T-Mobile says on its support account on X. “We are still committed to providing low prices and the most value across all plans.” The account also says that these changes should not affect customers with Price Lock.
A new third-party app store is launching for iPhone users in the European Union that describes itself as being “built specifically for mobile gamers.” Skich is the latest in a short list of alternative app marketplaces to take advantage of Apple’s App Store restrictions being loosened by the EU’s Digital Markets Act (DMA), including AltStore Pal, SetApp Mobile, and Mobivention.
The Skich Store is available to download in the EU for iOS via its official website starting today, and is claiming to offer a more “personalized experience” regarding game discovery and distribution compared to alternative app marketplaces. An Android version is also currently in development.
We should note, however, that Skich has no games available at launch. Aptoide, another gaming-focused third-party iOS app store, had eight basic titles when it launched last June, by comparison. Skich CEO Sergey Budkovski told The Verge that games will “start appearing on the platform in March,” and that the platform has received requests from around 20 developers “so far.”
“We’ve developed a Tinder-like recommendation system that perfectly matches gamers with games,” said Budkovski. “The algorithm behind it is powered by 240 genres, which is 14 times more than one can find in the App Store.”
We haven’t seen many third-party app stores launching since the DMA came into force in March last year. Even with an empty roster of gaming titles, that makes Skich notable, but we won’t be able to see if it truly does provide more optimized recommendations until it rectifies that issue.
Are you ready to use your daily commute to catch up on your favorite show, respond to emails or simply enjoy the view without worrying about the road ahead?
This vision of the future is becoming increasingly real thanks to advancements in autonomous driving technology. Stellantis, the parent company of brands like Dodge, Jeep and Chrysler, has just unveiled its STLA AutoDrive 1.0 system, which the company hopes will soon revolutionize the way we drive.
STLA AutoDrive 1.0 system (Stellantis)
The future of driving is here … almost
Stellantis has developed its cutting-edge Level 3 automated driving system. This innovative technology allows motorists to safely take their eyes off the road and hands off the wheel. Stellantis’ STLA AutoDrive 1.0 system is designed to handle driving tasks autonomously at speeds of up to 37 mph in traffic and on highways under certain conditions. This means drivers can potentially engage in activities like watching movies, reading books or catching up on emails during their commute.
GET EXPERT SECURITY ALERTS, MUST-KNOW TECH TIPS AND THE LATEST DIGITAL TRENDS STRAIGHT TO YOUR INBOX. SIGN UP FOR KURT’S THE CYBERGUY REPORT NOW
The system will manage steering, acceleration, braking and maintain safe distances from other vehicles without human intervention.
However, there’s a catch: Despite being fully developed and ready for deployment, Stellantis isn’t launching these features just yet. The company cites a limited market for Level 3 autonomous driving as the reason for holding back, that they’ll introduce the technology once the market becomes more receptive.
STLA AutoDrive 1.0 system (Stellantis)
ARE THESE AUTONOMOUS TRANSPORT PODS THE FUTURE OF SKY-HIGH COMMUTING?
What sets STLA AutoDrive apart?
STLA AutoDrive offers several impressive features that make it stand out in the world of autonomous driving. It offers hands-free and eyes-off functionality at speeds of up to 37 mph, allowing drivers to completely disengage from driving tasks. The system is designed to work at night and in light rain, providing reliable performance in various weather conditions.
Additionally, an automated sensor-cleaning system ensures that critical components remain clear for optimal reliability and functionality. Built on a cloud-connected platform, STLA AutoDrive can receive over-the-air updates to improve its capabilities, making it a scalable and adaptable technology. Furthermore, Stellantis hints at potential upgrades that could enable operation at speeds of up to 59 mph and even off-road automation.
HOW TO REMOVE YOUR PRIVATE DATA FROM THE INTERNET
STLA AutoDrive 1.0 system (Stellantis)
AUTONOMOUS ROBOTAXI SUCCESSFULLY COMPLETES 75 MPH HIGHWAY TESTING
The challenges of Level 3 autonomy
Level 3 autonomy, often referred to as “conditional automation,” presents unique challenges. The system can only be activated under certain driving conditions, requiring specific environmental and traffic criteria to be met. Also, drivers must remain alert and prepared to take control at a moment’s notice, which can be a difficult standard to maintain. Regulatory authorities also face challenges in setting and enforcing standards for this level of autonomy, as it requires a delicate balance between safety and technological innovation.
STLA AutoDrive 1.0 system (Stellantis)
SOLAR-POWERED AIRCRAFT ACHIEVES GROUNDBREAKING 22-HOUR AUTONOMOUS FLIGHT
The race for autonomous driving
Stellantis isn’t alone in the pursuit of Level 3 autonomy. Mercedes-Benz was the first to launch an SAE Level 3 system in commercial vehicles in Europe and the U.S. in 2023. Other major automakers, including Honda, Ford, GM, Volvo, Sony, Kia and Xpeng, are also developing their own Level 3 systems, indicating a competitive and rapidly evolving landscape in the automotive industry.
WHAT IS ARTIFICIAL INTELLIGENCE (AI)?
What this means for drivers
When STLA AutoDrive eventually hits the market, it could significantly change the driving experience. Automated driving in heavy traffic could make commutes less stressful, allowing you to relax or engage in other activities. Additionally, you might be able to use travel time more efficiently, whether that means catching up on work or enjoying leisure activities. Enhanced safety is another potential benefit, as advanced sensors and AI could reduce human error and improve overall road safety.
SUBSCRIBE TO KURT’S YOUTUBE CHANNEL FOR QUICK VIDEO TIPS ON HOW TO WORK ALL OF YOUR TECH DEVICES
STLA AutoDrive 1.0 system being used at night (Stellantis)
Kurt’s key takeaways
Stellantis’ STLA AutoDrive is no doubt a significant milestone toward fully autonomous vehicles. While the technology is ready, the market and regulatory landscape are still catching up. As automakers continue to push the boundaries of what’s possible, we’re inching closer to a future where cars truly drive themselves. However, the transition will likely be gradual, with safety and consumer acceptance playing crucial roles in the widespread adoption of Level 3 and beyond autonomous driving technologies.
Are you ready to take your hands off the wheel and let technology do the driving? Why or why not? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels:
Answers to the most-asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
Guitarist Mike Campbell had a challenging relationship with Tom Petty, but 'love and respect' never wavered
Why Gucci Picked Demna
Contributor: NPR faces a real threat in defunding fight that's coming
NCAA March Madness: What time is Selection Sunday? Who has an automatic bid?
Trump tariffs are proving ‘big headache’ for tech giants, says Foxconn
-
Politics1 week agoEXCLUSIVE: Elon Musk PAC thanks Trump for 'saving the American Dream' in new million-dollar ad
-
News6 days agoGene Hackman Lost His Wife and Caregiver, and Spent 7 Days Alone
-
Politics6 days agoRepublicans demand Trump cut American legal association out of nominee process
-
Politics6 days agoAgriculture secretary cancels $600K grant for study on menstrual cycles in transgender men
-
News6 days agoStates sue Trump administration over mass firings of federal employees
-
Movie Reviews1 week ago‘Black Bag’ Review: Cate Blanchett and Michael Fassbender Cozy Up in Steven Soderbergh’s Snazzy Spy Thriller
-
News1 week agoWho Paid for Trump’s Transition to Power? The Donors Are Still Unknown.
-
News6 days agoTrump Seeks to Bar Student Loan Relief to Workers Aiding Migrants and Trans Kids