← Campaigns

Cyberhaven

OAuth-phishing of extension developers led to malicious updates. GraphQL Network Inspector v2.22.6 injected credential/session-stealing JS. The only Chrome-extension incident with published file hashes.

Extensions
1
Stores
Chrome
Updated
2024-12-25
Disclosed
2024-12-25

Member extensions

1 extension
Campaign member extensions and their current risk
ExtensionStoreReported versionsCurrent risk
GraphQL Network Inspectorunknown-graphql-network-inspectorChrome2.22.6Unscored

Indicators

Download STIX →
Browse 2 indicators
TypeValue & evidence
sha256b0827dc54349b10098a7370ada4ea44ba668b264ccca2db5676be1c32e6cc154background.js
sha256d303047205dabec8e2d34431e920ebe3478ca80a18f57bf454da094aca0e10aacontext_responder.js

Research & sources

Read the investigation →