Highlight any new chrome extensions that have been found to be collecting and selling user data.

Security researchers identified the 'PolinRider' campaign on 4 July 2026, which utilized malicious Chrome extensions to harvest data from developers and cryptocurrency users. This discovery coincides with reports on the 'ConsentFix' technique, a browser-based attack that hijacks Microsoft 365 accounts by abusing OAuth flows, and the removal of a fake 'Perplexity AI' extension that intercepted search queries and address bar keystrokes. These findings highlight ongoing threats despite Google's recent policy crackdown on unauthorized data collection.

• PolinRider Campaign Discovery: On 4 July 2026, researchers linked the 'PolinRider' campaign to North Korean hackers who published 108 malicious packages and extensions, including a Chrome extension designed to deliver BeaverTail malware.
• Fake Perplexity AI Extension Removal: Reports on 3 July 2026 detailed the removal of 'Search for perplexity ai' (ID: flkebkiofojicogddingbdmcmkpbplcd), which was found to be intercepting all search traffic and keystrokes from the browser's address bar.
• ConsentFix Browser Attack: A security advisory on 3 July 2026 highlighted 'ConsentFix', a browser-native phishing method that hijacks Microsoft 365 session tokens by abusing legitimate OAuth flows without requiring passwords.
• Chrome Web Store Policy Enforcement: Google has set a deadline of 1 August 2026 for developers to comply with new rules that strictly limit data collection to the extension's single disclosed purpose and ban AI-jailbreaking tools. 📅 Calendar file (.ics) Chrome Web Store Policy Enforcement Deadline August 1, 2026

On 1 July 2026, Google implemented major Chrome Web Store policy updates to combat unauthorized data harvesting, mandating that extensions only collect data strictly necessary for their primary function. This regulatory shift follows the discovery of the 'AITOPIA' extension, which compromised the chat histories of over 900,000 users, and the 'Silent Swap' campaign that utilized counterfeit tools to hijack cryptocurrency transactions. These updates were released alongside Chrome 151, which patched 382 security vulnerabilities.

• Chrome Web Store Policy Update: Published on 1 July 2026, new policies require extensions to limit data collection to their 'disclosed single purpose' and mandate prominent disclosure of all data handling practices to users.
• AITOPIA Extension Discovery: Researchers identified the 'AITOPIA' extension on 1 July 2026, which impersonated AI tools to exfiltrate ChatGPT and DeepSeek chat histories from approximately 900,000 users.
• Silent Swap Campaign Disclosure: A security advisory on 1 July 2026 detailed the 'Silent Swap' campaign, which used a counterfeit Google Notes extension to intercept and reroute cryptocurrency transactions.
• Chrome 151 Security Release: Released on 1 July 2026, Chrome 151 addressed 382 vulnerabilities, including 15 critical flaws that could allow arbitrary code execution outside the browser sandbox.

Between 29 June and 1 July 2026, security researchers identified several new malicious Chrome extensions, including a fake 'Search for perplexity ai' tool that intercepted search queries and keystrokes. The 'StegoAd' campaign was also revealed to involve 119 extensions affecting 2.6 million users, while the release of Chrome 151 on 30 June 2026 addressed 382 security vulnerabilities and finalized the removal of Manifest V2 support.

• Fake Perplexity AI Extension Discovery: Reported on 29 June 2026, the extension 'Search for perplexity ai' (ID: flkebkiofojicogddingbdmcmkpbplcd) was found intercepting search traffic and logging every character typed in the address bar before being removed by Google.
• StegoAd Campaign Expansion: A report on 29 June 2026 detailed the 'StegoAd' campaign, which utilized 119 malicious extensions (up from 108 previously reported) to exfiltrate cookies, Google credentials, and 2FA codes from 2.6 million users.
• Chrome 151 Security Update: Released on 30 June 2026, Chrome 151 patched 382 security vulnerabilities, including 15 critical flaws, and removed the final technical workarounds for legacy Manifest V2 extensions.
• Google Notes Crypto Clipper: On 30 June 2026, researchers identified a malicious extension masquerading as 'Google Notes' that functions as a crypto clipper, swapping wallet addresses to steal funds by bypassing Chromium security layers.

On 27 June 2026, security researchers disclosed a major campaign involving 108 malicious Chrome extensions designed to harvest sensitive user data, including Google profile information and session cookies. This discovery marks a significant escalation from earlier June reports of individual threats like the 'Cloud vn105rkj64' extension, revealing a coordinated effort using a single command-and-control infrastructure to bypass security measures and inject unauthorized advertisements.

• Discovery of 108 Malicious Extensions: Reported on 27 June 2026, a coordinated campaign of 108 extensions was found stealing sensitive data, including authenticated session cookies and Google profile information, via a unified command-and-control (C2) infrastructure.
• Targeted Data Harvesting Details: Within the identified campaign, 54 extensions specifically target Google account data, while 45 others contain persistent backdoors that activate upon browser startup to monitor user activity and inject scripts.
• Chrome 150 Manifest V2 Phase-out: Scheduled for 30 June 2026, the release of Chrome 150 is expected to remove the final technical workaround for Manifest V2 extensions, effectively disabling many legacy ad-blocking and utility tools. 📅 Calendar file (.ics) Chrome 150 Release (Manifest V2 Phase-out) June 30, 2026