As discovered by Malwarebytes researcher Pieter Arntz, a new pair of extensions plaguing Google’s Chrome and Mozilla’s Firefox can hijack the browsers in order to push technical support scams at you and potentially even spy on your browsing activities.
Called “Tiempo en colombia en vivo” on the Chrome Web Store, the rogue extension can be installed on a machine when the user visits certain sites; trying to leave a malicious site results in an infinite loop of dialog boxes cautioning the user that they can’t leave the page until they install the extension. If they try to leave still, and choose the option to “Prevent this page from creating additional dialogs,” the tab will go into full screen mode and offer the ‘Add extension’ dialog popup that shows up when installing a Chrome extension.
If the user ends up installing the extension, it will proceed by hijacking their browser searches and redirect them to certain pages or YouTube videos in order to increase their views.
Interestingly, the extension is designed to also make its removal a difficult procedure; the first measure taken to ensure this is to redirect users from the ‘chrome://extensions/’ page where they could manage and delete the extension to ‘chrome://apps/?r=extensions’, which simply lists the various Chrome apps and extensions that they have installed.