Open Source · · 4 days
Nano extensions shipped malicious updates
After Nano Adblocker and Nano Defender changed hands, Chrome Web Store updates added malicious code that collected browsing data and abused logged-in social sessions.
Nano Adblocker and Nano Defender were Chromium extensions derived from the uBlock Origin ecosystem. In October 2020, maintainer Hugo Xu announced he no longer had time to maintain the projects and transferred the Chrome Web Store rights to new developers.
The trust boundary moved with the store listing. Existing users did not install a lookalike extension; their browsers accepted updates under the established Nano extension identities. Raymond Hill and community reviewers quickly warned that the new releases contained malicious code.
The payload collected browsing data and sent a report file to def.dev-nano.com. Users also observed browser sessions issuing Instagram likes without user action, which showed that extension privileges reached authenticated social sessions.
Google removed the extensions from the Chrome Web Store after the reports. The Firefox variants were maintained separately and were reported not to have received the malicious Chrome Web Store code, so this record is scoped to the Chromium distribution path.
Appendix · Affected releases
- Public reporting gives the Chrome Web Store extension identity but not a durable malicious version number in the cited sources.
- Public reporting separated the Chrome Web Store releases from Firefox variants, which were maintained by a different developer.
Indicators
- domaindef.dev-nano.com
- urlhttps://def.dev-nano.com/
- filereport
- observableBrowsers issued Instagram likes without user action.
- observableChrome Web Store rights were sold to new developers before malicious updates.
References
Source record: oss/attacks/nano-adblocker-defender/meta.yaml