Cyberhaven Chrome extension compromise distributes malicious trusted update

A phishing attack on December 24, 2024 compromised a Cyberhaven employee's Chrome Web Store access, allowing an attacker to publish malicious version 24.10.4 of Cyberhaven's legitimate browser extension. The trusted update channel exposed downstream corporate users to theft of authenticated sessions and cookies until the malicious version was removed and replaced. Public reporting characterized the event as part of a broader campaign against Chrome extension developers; no specific actor was confirmed.