Chrome Extension Hijacked, 1M+ Users Hit by Malware

🔑 Enhanced Key Takeaways

• •The malware in 'Save image as Type' injected affiliate links from 578 identifiable sites into users' clicks, stealing commissions from purchases.[3]
• •Extension ownership changed in late 2025 from Image4Tools to 'Lauren Bridge', likely indicating a sale that preceded the malicious activity.[3]
• •Microsoft removed the Edge version of the extension in February 2025 after detecting malware, over a year before Google's action.[1][3][5]

🛠️ Technical Deep Dive

• •Malicious code located in inject.js file communicated with a remote server to compile a list of URLs and inject corresponding affiliate codes.[3]
• •Extension modified affiliate links on sites like Amazon and Best Buy, similar to tactics used by the Honey extension in 2024.[2]

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline