16 Malicious Chrome Extensions Infected Over 3.2 Million Users

In February 2025, GitLab Threat Intelligence discovered 16 malicious Chrome extensions that infected over 3.2 million users worldwide. These extensions, disguised as screen capture tools and ad blockers, stripped browser security protections, hijacked user sessions, and manipulated browsing behavior through advertising fraud and search engine optimization tactics. By disabling Content Security Policy headers and injecting obfuscated scripts, the extensions could redirect traffic, harvest browsing histories, and potentially expose user credentials. GitLab’s own write-up dates the activity back to at least July 2024 and assesses that the operator acquired at least some of the extensions from their original developers rather than compromising them. All of them were gone from the Chrome Web Store by the time GitLab published, but removal from the store does not uninstall them, so affected users still have to clean up by hand.