Cybersecurity experts have uncovered a widespread hacking campaign targeting Google Chrome and Microsoft Edge.
Criminals are posting malicious websites on the popular search engines, which masquerade as legitimate software for sites like YouTube and Roblox.
When victims download the fake software, they allow bad actors to access login credentials for sensitive data and other personal information that could include banking details.
Experts explained that this malware is particularly dangerous because it can’t be removed by simply deleting the file because it will reinstall each time the PC device restarts, but have identified specific extensions used in the attacks.
At least 300,000 people have fallen victim to the nationwide malware attack since 2021, according to ReasonLabs that uncovered the attack.
Kobi Kalif, CEO and co-founder of ReasonLabs, said: ‘This newly discovered malware campaign is just the latest example of how cybercriminals are targeting consumers in the digisphere.
‘Our research team remains committed to hunting these threats and providing our users with the tools, knowledge, and information to stay protected online.
‘We alerted Google and Microsoft as soon as we became aware of the issue and they are taking the appropriate measures.’
People have unwittingly downloaded the software thinking they’re installing a Chrome extension, but are instead uploading a PowerShell Script to the computer.
PowerShell is Microsoft’s version of a command-line tool for Windows, which are programs designed for more experienced coders to program their own computer’s core code directly.
The hackers’ fake error messages encourage unwitting users to copy and paste raw code and then install it as a ‘fix’ by running or ‘executing’ that code in PowerShell.
This downloads what’s called a ‘next-stage payload,’ which connects the hacker’s remote server to the victim’s computer to modify the Window Registry and force Chrome and Edge to fully install the malicious software.
Once added to the PC device, ‘the extension cannot be disabled by the user, even with Developer Mode ‘ON,” ReasonLabs said.
Developer Mode is used to protect people from installing harmful software on their computers to reduce the possibility of becoming the target of a cyberattack.
The hackers can then steal user queries from sites like Ask.com, Bing and Google, giving them access to the user’s data.
DailyMail.com has reached out to Google and Microsoft for comment.