Targeted supply chain attack against Chrome browser extensions

Sekoia describes a December 2024 supply-chain campaign where attackers phished Chrome extension developers to authorize a malicious OAuth app, used it to publish compromised updates to roughly a dozen extensions (potentially impacting hundreds of thousands of users), and injected scripts to harvest API keys, session cookies and other authentication data from services such as ChatGPT and Facebook Business; the report details the malicious code, attacker infrastructure, IoCs and remediation guidance.