The extensions, including ad blockers, screen capture tools, and emoji keyboards, were found injecting harmful code into browsers. GitLab says attackers hijacked these extensions through phishing or by acquiring them from developers, using them to bypass security protections and manipulate content.

Once installed, the extensions connect to a remote server, receive hidden commands, and strip security measures from websites. Although Google has removed them from the Chrome Web Store, the warning to users is to manually uninstall them to stay protected.

Compromised extensions include Blipshot, WAToolkit, Super Dark Mode, and Adblock for Chrome. Experts warn that high download counts and positive reviews do not guarantee safety, as attackers often hijack trusted extensions.

Businesses should restrict unverified extensions, review permissions regularly, and use endpoint security to prevent such threats. Monitoring browser activity can also help detect potential risks early.

 

The apps, which have now been removed from the Google Play store, are reported to have been downloaded hundreds of thousands of times.

 

Detailed information about how each of the apps infects devices, and a list of the thirteen malicious apps that were present in the Google Play Store, can be found on McAfee’s website here.

 

The advice is to avoid using apps that require accessibility services unless there is a genuine need for their use, install security software on your device, and always keep the security software up to date.