Leak at Cyberhaven

On 25 December 2024, Cyberhaven — a US-based data-loss-prevention and insider-threat security vendor — disclosed that its official Chrome browser extension had been compromised in a supply-chain attack. An employee was tricked by a phishing email impersonating Google's Chrome Web Store support, which led them to authorize a malicious OAuth application ("Privacy Policy Extension"). This gave the attackers access to the company's developer account, from which they published a trojanized update of the Cyberhaven extension.

The poisoned version (v24.10.4) auto-propagated to roughly 400,000 users and was live from around 01:32 UTC on 25 December to 02:50 UTC on 26 December — timing chosen to coincide with the Christmas holiday when security teams were thinly staffed. The malicious code acted as an infostealer, injecting JavaScript into web pages to harvest authenticated sessions, with a particular focus on Facebook and AI-platform credentials.

Exposed / targeted data included:

• Browser cookies and authenticated session tokens
• Facebook access tokens, user IDs and account data
• API keys for platforms such as OpenAI

Investigators later linked the incident to a broader campaign that compromised more than 30 other Chrome extensions, affecting an estimated 2.6 million users in total. Cyberhaven's security team detected and pulled the malicious build within about 60 minutes of discovery, published a verified clean release (v24.10.5), and urged affected users to rotate passwords, revoke and reissue API keys, and review account activity.