Users of Google Chrome are urged to remove 16 harmful browser extensions that pose significant security risks and could result in fraudulent activities orchestrated by an active cybercriminal.

These troubling extensions interfere with features such as screen capturing, ad-blocking, and emoji functionalities, potentially impacting over 3.2 million users, as reported by GitLab Threat Intelligence.

These extensions introduce malicious scripts that compromise browser security, enabling hackers to capture user data and perpetrate fraud through search engine advertising, according to Tom’s Guide.

Initially appearing legitimate, these extensions were compromised after users permitted their installation, allowing harmful updates to infiltrate them.

As reported by Notebook Check, the source of the attack involved developer accounts that inadvertently relinquished control of the extensions to the attackers, who then released malicious updates through official browser extension marketplaces.

The compromised extensions include:

• Blipshot
• Emojis (Emoji Keyboard)
• Color Changer for YouTube
• Video Effects for YouTube and Audio Enhancer
• Themes for Chrome and YouTube Picture in Picture
• Mike Adblock für Chrome
• Super Dark Mode
• Emoji Keyboard Emojis for Chrome
• Adblocker for Chrome (NoAds)
• Adblock for You
• Adblock for Chrome
• Nimble Capture
• KProxy
• Page Refresh
• Wistia Video Downloader
• WAToolkit

Although these risky extensions have been removed from the Chrome Web Store, users are advised to uninstall them manually if they remain active in their browsers.

Furthermore, Tom’s Guide recommends running a thorough scan with antivirus software to detect any potential malware or viruses.