Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability
2026-06-25T19:24:16Z•1544f17aa626cae1003433996e8fe63a9966a110ae0ff0629255fa7e05a064e2
active-exploitationbackdoorbrowser-extensionchrome-extensionci-cdciscocredential-harvestdifytapfortigatelantronixmacosmalwarenpmprompt-injectionsd-wansquidbleedsupply-chainunified-cmwordpresszero-day
What happened
A batch of high-impact security stories: multiple actively exploited vulnerabilities (notably Cisco Catalyst SD‑WAN and Cisco Unified CM) and a critical Lantronix EDS5000 flaw have been observed in the wild, while large-scale campaigns and supply‑chain compromises continue to proliferate. A popular Chrome extension (Adblock for YouTube, 10M+ installs) contains dormant arbitrary JavaScript injection capability; supply‑chain attacks were found in WordPress plugins (ShapedPlugin) and malicious npm packages delivering a Windows RAT; CI/CD workflow weaknesses (Cordyceps) and GitHub actions mitig-mt
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 1544f17aa626cae1003433996e8fe63a9966a110ae0ff0629255fa7e05a064e2
- Enrichment time
- 2026-06-25T19:24:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.