The latest abuse involves a Google Chrome extension being spread in phishing emails that steals any data posted online by victims. This is a departure from previous attacks that monitor browser activity for specific URLs and extract credentials. The extension captures all data posted by the victim on any website, Marinho said, before it s sent to a command and control server using Ajax and Ajax connections. Marinho says he expects cybercriminals to continue to make use of malicious extensions to access a victim’s personal or sensitive data.
Source: https://threatpost.com/malicious-chrome-extension-steals-data-posted-to-any-website/128680/