Cyberhaven Extension Compromise, DoubleClickjacking

High Risk Google OAuth Scopes grant excessive permissions that allow malicious applications to access sensitive user data. Attackers can exploit these broad permissions to exfiltrate confidential data, monitor communications, or perform unauthorized actions.

Defend With SquareX

Create an identity policy to Block high risk Google OAuth scopes.

Affected Companies:

Blogs:

Cyberhaven's Preliminary Analysis of the Recent Malicious Chrome Extension - Cyberhaven Targeted Supply Chain Attack Against Chrome Browser Extensions - SEKOIA New Details Reveal How Hackers Hijacked 35 Google Chrome Extensions - BleepingComputer Cyber Firm's Chrome Extension Hijacked to Steal User Passwords - TechCrunch Cyberhaven Supply Chain Attack: Exploiting Browser Extensions - Darktrace

Example Policy

Screenshot for Block High Risk Google OAuth Scopes

Follow These Steps

Click on Launch Attack Simulation button
Click on Login with Google
With SQRX enabled, Authorization will get blocked

Details

Attackers exploit Google OAuth by tricking users into granting excessive permissions that go far beyond what an app should need. Malicious apps often request high-risk scopes such as full Drive access, Gmail read/modify, or contacts export, which allow threat actors to exfiltrate files, read emails, and impersonate accounts without stealing credentials or triggering MFA. Once tokens are issued, attackers gain persistent access until explicitly revoked, making this a stealthy and long-lived intrusion method. Real-world incidents, such as the Cyberhaven Chrome extension compromise, show how malicious OAuth apps can bypass corporate defenses and abuse granted privileges to inject code, sync confidential data, or hijack business accounts. The attackers then uploaded a trojanized version (v24.10.4) of the Cyberhaven extension, which injected two malicious scripts, worker.js and content.js. These scripts contacted a hard-coded C2 domain (cyberhavenext[.]pro) and waited for users to visit Facebook.com, harvesting access tokens, cookies, ad-account IDs, and business-account information.

Impact

The abuse of high-risk Google OAuth scopes has serious consequences for both individuals and organizations. Once granted, attackers can silently siphon sensitive files from Google Drive, read or manipulate Gmail communications, and exfiltrate contacts or calendars, leading to large-scale data breaches and privacy violations. Since OAuth tokens bypass traditional credential theft defenses, victims may remain unaware until significant damage is done. For organizations, this results in intellectual property theft, financial fraud, and regulatory non-compliance, especially when confidential data leaves the managed environment. Attackers can also impersonate employees in email or shared drives, spreading phishing campaigns internally while maintaining long-term persistence. The difficulty of detecting and revoking malicious OAuth access amplifies the impact, often prolonging exposure and magnifying reputational harm.

Indicator of Compromise (IOC)

- Malicious OAuth application requesting unnecessary high-risk permissions. - Unauthorized extension updates appearing without developer intent. - Outbound traffic to external C2 infrastructure.