Google Chrome extension that steals card numbers still available on Web Store

[silversurfer]

A malicious Google Chrome extension that can recognize and steal payment card details entered in web forms is still available on the Chrome Web Store.

The extension is the work of a cyber-criminal group and has been at the heart of a malware distribution effort in the past.

The website through which the extension was initially distributed is now down, but the extension is still available on the Play Store, meaning it could be used for future campaigns to infect new users.

Until now, the extension has been installed by roughly 400 users, according to stats available on its official Chrome Web Store listing.

The extension's name is Flash Reader. According to a report from ElevenPaths, Telefonica's cyber-security division, the extension was distributed via http://fbsgang[.]info/flashplayer/, a page to which crooks redirected web traffic, possibly from malvertising campaigns or exploit kits.

The page used the classic lure of "you don't have Flash installed, use this Chrome extension instead," and redirected users to Flash Reader's official Chrome Web Store page to install it.

According to a review of the extension's code performed by this reporter and a third-party --to confirm ElevenPath's findings-- the extension contained code that intercepted any form submission made on any web page.

Source: https://www.zdnet.com/article/google-chr...web-store/