How to find and remove credential-stealing Chrome extensions

Researchers uncovered 30 credential-stealing Chrome extensions affecting over 260,000 users; these add-ons used a remotely hosted, full-screen iframe to impersonate an interface and harvest credentials while evading Web Store review. The report explains the “extension spraying” tactic, lists the malicious extension IDs/names for detection, and provides practical steps to find and remove suspicious extensions via chrome://extensions (Developer mode) or the local Extensions folder, noting that force-installed entries may indicate policy or malware involvement.