Browser Extensions Can Steal Everything

Do you know a browser extension can basically steal everything going on in your browser?

Honestly, most of us just click “Allow” when the permission popup shows up. We want the tool to work. But with the right (or wrong) permissions, a malicious extension can do a lot more than it claims.

It can read every page you visit in real time. Banking sites, email, documents, whatever’s open. It can grab your session cookies — those little tokens that keep you logged in — so the attacker gets in as you without needing your password. It can log every keystroke you type. It can inject code into pages you’re already on, change what you see, or drop a fake payment field on a checkout page. It can even route your traffic through someone else’s server or quietly record conversations you have with AI chatbots.

This isn’t theoretical. In April 2026 researchers found 108 malicious Chrome extensions. Telegram tools, video helpers, productivity add-ons — about 20,000 downloads total, all sending data to the same backend.

Two extensions called Phantom Shuttle had been active since 2017. Nine years of quietly routing users’ traffic through attacker servers. One extension was stealing Meta Business Suite 2FA codes while its privacy policy claimed the data stayed local. And in February 2026, 287 Chrome extensions got caught selling users’ complete browsing history to data brokers, including Similarweb. Legally. Buried in the terms.

The scariest version might be the trusted ones that turn bad. A developer’s account gets phished, a weaponized update gets pushed, and every existing user who already trusts the add-on gets hit. No new install required.

What to do right now is pretty simple. Open your browser’s extensions page. Remove anything you don’t actively use. Then check the permissions on what’s left. An ad blocker doesn’t need “read and change all your data on all websites” just to block ads. If it’s asking for that, ask why.

Kinda boring advice, but it works. Clean house every few months and you’ll cut a lot of risk.

Sources:
IT Guy (@T3chFalcon) on X

Trending

Mystery behind how the X chromosome gets it shape could finally be resolved

Image
Scientists believe they have resolved one of the great mysteries of life - how chromosomes get their X shape. Chromosomes are long DNA molecules which contain the genetic material of an organism. These structures were discovered in the late 1800s after the light microscope was invented. They have an X shape, but the reason behind this has always been a mystery. It is known that they get their shape during cell division but researchers wanted to know how that happened. Scientists led by Professor Daniel Panne, of the University of Leicester, and Dr Benjamin Rowland, of the Netherlands Cancer Institute, think the answer lies in a protein called shugoshin which "locks" the chromosomes into X shapes. When a cell divides, it copies the DNA and splits it equally between the two new cells. DNA in each cell is about two metres long, so that has to be made into compact parcels to make it fit. The cells leave the two copies attached in the middle until they divide. Under th...
Continue

Nekogram Dev Admits Collecting Phone Number Links

Image
This morning things got spicy in the Telegram mod scene. The developer of Nekogram basically admitted that the app collects info about which account is linked to which phone number. Someone (Sota) dropped the Extra.java code fragment, and a few hours later the dev himself said in his chat: “If your question is ‘Is it true?’, the answer is yes, numbers were sent to the bot.” He followed up with something like “what kind of explanation do you need? It is exactly what it looks like; it is what it is.” The dev claims no numbers were actually stored or shared with anyone, and that people might find that hard to believe. Honestly, yeah… it is kinda hard to believe without seeing the full picture. There's also mention of the data going to some “breakthrough” bots, but he didn't really address that part. One of those bots even admitted Nekogram is using their TgDB search bot automatically (without their knowledge or partnership), probably to look up usernames. If ...
Continue

xAI Launches Grok Bot - AI Teammates With Own Computer

xAI dropped Grok Bot in early beta a couple days ago. These aren't the usual chatbots. Each one gets its own computer up in the cloud. They log into the same tools and apps you already use email, CRM, whatever and actually finish the job. You can close your laptop and they keep going. Inside the company they were already running them for sales outbound, processing invoices from Gmail, reproducing bugs, the works. Now it's open to SuperGrok Heavy, Cursor Ultra, and Cursor Teams Premium people on desktop and iOS. You just message them like a coworker. Show one how you do a multi-step thing once and it remembers the routine. You can spin up a few at the same time and they even talk to each other. Honestly, the "own computer" part is what makes it feel different. Most agents still feel like they're stuck in a chat window. This one works where the real work lives. Still early days, but kinda interesting to watch how this plays out. Sources: xAI - Introduci...
Continue