{"id":3694,"date":"2026-03-24T09:49:23","date_gmt":"2026-03-24T07:49:23","guid":{"rendered":"https:\/\/computershop.eu\/blog\/?p=3686"},"modified":"2026-03-24T09:49:23","modified_gmt":"2026-03-24T07:49:23","slug":"compromised-chrome-extension-over-1-million-users-affected","status":"publish","type":"post","link":"https:\/\/computershop.eu\/blog\/compromised-chrome-extension-over-1-million-users-affected","title":{"rendered":"Compromised Chrome extension: over 1 million users affected"},"content":{"rendered":"Reading Time: <\/span> 2<\/span> minutes<\/span><\/span>\n

A new cybersecurity incident draws attention to vulnerabilities in the browser extension ecosystem. A popular Chrome extension, used for saving images in various formats, has been compromised and turned into a malicious tool, affecting over 1 million users globally.<\/p>\n\n\n\n

In this article, you will find out what happened, how the attack worked, what risks it involves, and how you can protect yourself.<\/p>\n\n\n\n

\u201cSave Image as Type\u201d was a popular Chrome extension<\/h2>\n\n\n\n

The \u201cSave Image as Type\u201d extension was a widely used tool by Chrome users to quickly convert images from modern formats like WebP to more common formats such as JPG or PNG. Its popularity grew with the adoption of modern image formats, which are more efficient but not always compatible with all applications.<\/p>\n\n\n\n

However, this seemingly trivial utility caught the attention of attackers, who took advantage of its large user base and the trust built over time.<\/p>\n\n\n\n

How the extension was compromised<\/h2>\n\n\n\n

Instead of creating a malicious extension from scratch, hackers adopted a more subtle strategy: they acquired the extension from the original developer.<\/p>\n\n\n\n

After the takeover, they introduced malicious code in subsequent updates. Essentially, users continued to use the extension without knowing that it had become an attack tool.<\/p>\n\n\n\n

This technique is increasingly common in cybersecurity, as it exploits existing trust in popular applications.<\/p>\n\n\n\n

What the malicious code introduced into the popular Chrome extension did<\/h2>\n\n\n\n

The main purpose of the attack was not direct theft of passwords or sensitive data, but fraudulent monetization through the manipulation of affiliate links.<\/p>\n\n\n\n

Specifically, the extension:<\/strong><\/p>\n\n\n\n