<h1>RedDirection Campaign: Browser Marketplace Vulnerabilities Exposed</h1>
<p>Security researchers have uncovered a large-scale browser hijacking campaign called RedDirection, impacting 2.3 million users of Chrome and Edge. This campaign deployed 18 malicious browser extensions, which initially appeared legitimate due to verified badges and high ratings on respective marketplaces.</p>
<p>Among these extensions was a popular tool, including a color picker from Geco, that began as functional and trustworthy software. However, in a sophisticated twist, these extensions were later updated with surveillance code via automatic updates. This covert transformation facilitated the collection of browsing data, enabling attackers to conduct phishing attacks and redirect users to malicious servers.</p>
<p>The RedDirection campaign exploited trust mechanisms inherent in browser marketplaces, unveiling significant deficiencies in extension review processes. This incident underscores how attackers can leverage legitimate-looking extensions for persistent surveillance and credential theft, bypassing user awareness and circumventing initial security checks. This breach highlighted the urgent need for more rigorous oversight and security enhancements in browser extension marketplaces to protect users from threats masked as ordinary applications.</p>


Collections

Security researchers discovered the RedDirection campaign, a browser hijacking operation that infected 2.3 million Chrome and Edge users through 18 malicious extensions. These extensions initially appeared legitimate with verified badges and high ratings, but were later updated with surveillance code that collected browsing data and enabled phishing attacks. The campaign exposed critical vulnerabilities in browser marketplace review processes and highlighted the need for stronger security oversight.