Bitcoin hijackers found at least one sucker for scam Chrome extension • The Register

Security researchers have caught a Bitcoin-hijacking Chrome extension that only managed to grab one BitCoin transaction before being exposed.

Trend Micro researchers said the malicious extensions used an attack technique that first emerged last year, dubbed FacexWorm, and added that they noticed re-emerging activity earlier this month.

FacexWorm propagates in malicious Facebook Messenger messages, the company said, and only attacks Chrome; if another browser is detected, the user is directed to an innocuous advertisement.

Victims were tricked into installing the malicious extension as a codec extension, offered when they clicked a Facebook Messenger link to a YouTube video.

“FacexWorm is a clone of a normal Chrome extension but injected with short code containing its main routine,” the post said. “It downloads additional JavaScript code from the C&C server when the browser is…