Researchers Warn Poper Blocker Chrome Extension Distributes Spyware

Key points

• Security analysts have discovered that the Poper Blocker extension for Chrome acts as spyware.
• The add-on reportedly steals confidential user data and sends it to unknown parties.
• It has been installed by millions of people via the Chrome Web Store.
• Google's store is the distribution platform for the compromised extension.
• No CVE has been issued, and the threat level is rated medium.

Security researchers have raised alarms about a popular Chrome extension called Poper Blocker. According to their findings, the add-on, which has been installed by millions of users, is being used to spread spyware. The extension is available through Google's Chrome Web Store.

The spyware allegedly performs data exfiltration, stealing sensitive information from affected systems. This means personal or organizational data could be compromised without users' knowledge. The developers behind Poper Blocker are the actors responsible for distributing this malicious code.

Because the extension has millions of downloads, the impact is broad. Anyone who added it to their Chrome browser may be at risk. The Chrome Web Store, operated by Google, served as the hosting platform for the extension, allowing it to reach a large audience.

Researchers have issued warnings about this threat, but as of now, no CVE identifiers have been assigned. The severity is considered medium, indicating a significant but not critical risk. The lack of a CVE does not diminish the need for vigilance.

What to watch: Users should monitor for updates from Google or security researchers regarding the extension's status. If you have Poper Blocker installed, consider removing it and checking for signs of data compromise. IT admins should review extension policies and block or remove risky add-ons.

What to do now

1. Immediately identify and uninstall the Poper Blocker extension from all managed Chrome browsers.
2. Block the extension via enterprise policy, such as Chrome's ExtensionInstallBlocklist.
3. Scan affected endpoints for indicators of data exfiltration and spyware.
4. Reset credentials for users who had the extension installed, especially for sensitive accounts.
5. Review Chrome Web Store permissions and restrict non-approved extensions.
6. Monitor network traffic for unusual outbound connections to unknown domains.
7. Educate users about the risks of installing unvetted browser extensions.

Original source

Dark Reading