A phishing campaign took over 35 popular Google Chrome extensions and captured sensitive information from millions of users. You can see which extensions were hacked in the list below.
If you use any of the extensions below, remove it immediately and change your passwords.Hacked extensions.
| Extension Name | Status | Version / Identifier |
|---|---|---|
| Where is Cookie? | Not yet addressed | emedckhdnioeieppmeojgegjfkhdlaeo |
| Web Mirror | Not yet addressed | eaijffijbobmnonfhilihbejadplhddo |
| ChatGPT App | Not yet addressed | lbneaaedflankmgmfbmaplggbmjjmbae |
| Hi AI | Not yet addressed | hmiaoahjllhfgebflooeeefeiafpkfde |
| Web3Password Manager | Not yet addressed | pdkmmfdfggfpibdjbbghggcllhhainjo |
| YesCaptcha assistant | Not yet addressed | jiofmdifioeejeilfkpegipdjiopiekl@1.1.61 |
| Bookmark Favicon Changer | Addressed | 5.1 / acmfnomgphggonodopogfbmkneepfgnh@4.00 |
| Proxy SwitchyOmega (V3) | Not yet addressed | hihblcmlaaademjlakdpicchbjnnnkbo@3.0.2 |
| GraphQL Network Inspector | Addressed | 2.22.7 / ndlbedplllcgconngcnfmkadhokfaaln@2.22.6 |
| AI Assistant | Removed from store | bibjgkidgpfbblifamdlkdlhgihmfohh |
| Bard AI chat | Removed from store | pkgciiiancapdlpcbppfkmeaieppikkk |
| ChatGPT for Google Meet | Removed from store | epdjhgbipjpbbhoccdeipghoihibnfja |
| Search Copilot AI Assistant for Chrome | Removed from store | bbdnohkpnbkdkmnkddobeafboooinpla |
| TinaMind | Addressed | 2.14.0 / befflofjcniongenjmbkgkoljhgliihe |
| Wayin AI | Addressed | 0.0.11 / cedgndijpacnfbdggppddacngjfdkaca |
| VPNCity | Not yet addressed | nnpnnpemnckcfdebeekibpiijlicmpom |
| Internxt VPN | Addressed | 1.2.0 / dpggmcodlahmljkhlmpgpdcffdaoccni |
| Vidnoz Flex | Removed from store | cplhlgabfijoiabgkigdafklbhhdkahj |
| VidHelper | Not yet addressed | egmennebgadmncfjafcemlecimkepcle |
| Castorus | Addressed | 4.41 / mnhffkhmpnefgklngfmlndmkimimbphc |
| Uvoice | Not yet addressed | oaikpkmjciadfpddlpjjdapglcihgdle |
| Reader Mode | Not yet addressed | fbmlcbhdmilaggedifpihjgkkmdgeljh |
| ParrotTalks | Not yet addressed | kkodiihpgodmdankclfibbiphjkfdenh |
| Primus | Addressed | 3.20.0 / oeiomhmbaapihbilkfkhmlajkeegnjhe |
| Keyboard History Recorder | Not yet addressed | igbodamhgjohafcenbcljfegbipdfjpk |
| ChatGPT Assistant | Not yet addressed | bgejafhieobnfpjlpcjjggoboebonfcg |
| Reader Mode | Removed from store | llimhhconnjiflfimocjggfjdlmlhblm |
| Visual Effects for Google Meet | Addressed | 3.2.4 / hodiladlefdpcbemnbbcpclbmknkiaem |
| AI Shop Buddy | Not yet addressed | epikoohpebngmakjinphfiagogjcnddm |
| Cyberhaven V3 Security Extension | Addressed | pajkjnmeojmbapicmbpliphjmcekeaac |
| Earny | Not yet addressed | oghbgbkiojdollpjbhbamafmedkeockb |
| Rewards Search Automator | Not yet addressed | eanofdhdfbcalhflpbdipkjjkoimeeod |
| Tackker | Addressed | ekpkdmohpdnebfedjjfklhpefgpgaaji |
| Sort By | Not yet addressed | miglaibdlgminlepgeifekifakochlka |
| Email Hunter | Not yet addressed | mbindhfolmpijhodmgkloeeppmkhpmhc |
What should be done?
For users:
- Immediately remove or update the affected extensions.
- Reset passwords and revoke active sessions.
- Review browser extension permissions and make sure they are still appropriate.
- Monitor unusual activity in your personal and work accounts
- Be cautious of suspicious emails, especially those claiming to be from Google.
Share your experience
Got a question, a different solution or a note to add?
Log in or join us to write a comment.
Log in ↗︎Sign up ↗︎