SquareX Researchers Expose OAuth Attack on Chrome Extensions Days Before Major Breach

**Executive summary:** A malicious update to Cyberhaven’s Chrome extension was published to the Chrome Web Store on 25 December 2024 after attackers phished extension developers to grant OAuth permissions, enabling session hijacking and exfiltration of credentials across multiple sites; the malicious build was live for over 30 hours and the extension had roughly 400,000 users, illustrating a high-impact supply-chain campaign against browser extensions and a wider trend identified by SquareX.