MEGA's Chrome extension has recently been hacked and poses risks to users of cryptocurrency wallets. Compromised companies include MyMonero, MyEtherWallet as well as Amazon, Microsoft and Google. Security researcher of the open-source cryptocurrency provider Monero "SerHack" first discovered this hack. Stating "It catches your username and password from Amazon, GitHub, Google, Microsoft portals!" this news has caused a large amount of concern for users of MEGA's chrome extension. MEGA's extension could damage users financially. While the enforcement of GDPR this year certainly has helped to protect user information, unexpected attacks still pose threats.
What caused this?
MEGA states that this attack was caused by an adversary uploading a "trojaned version of MEGA's Chrome Extension." MEGA defended itself by stating that they use strict procedure policies. "Google decided to disallow publisher signatures on Chrome extensions and is now relying solely on signing them automatically after upload to the Chrome webstore, which removes an important barrier to external compromise" stated MEGA. Regardless of the cause of this threat, MEGA's extension is particularly worrying for many users. MEGA states that users are only affected if they "had the MEGA Chrome extension installed at the time of the incident, autoupdate enabled and you accepted the additional permission, or if you freshly installed version 3.39.4". The extent of this risk could be potentially damaging for businesses, particularly those with employees that use MEGA's plugin. It now seems apparent that many companies might need an advanced security system to detect threats before they occur. Downloading malware through apps is not something new to users. Hundreds of thousands of users download malware regularly through Google Play via apps that bypass security measures.
