【資安訊息】瀏覽器擴充功能遭惡意劫持威脅活動，敬請加強擴充功能安全管理

【行政公告】

公告單位	計算機與資訊網路中心
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安訊息】瀏覽器擴充功能遭惡意劫持威脅活動，敬請加強擴充功能安全管理 [Security Information] Browser extensions are being hijacked by malicious threats. Please strengthen the security management of extensions
公告內容	轉發國家資安資訊分享與分析中心 NISAC-400-202507-00000048 [內容說明] 資安院觀測外部資安情資，近期發現駭客針對瀏覽器擴充功能進行惡意劫持活動（如Red Direction活動），其攻擊手法為利用合法之擴充功能，於後續更新中植入惡意程式碼，可監控使用者網頁瀏覽活動並傳送至C2伺服器，甚至導向釣魚網站。影響範圍： Chrome 與 Edge 共計18種擴充功能，其可能含蓋超過230萬名使用者。詳細清單下載連結：https://cert.tanet.edu.tw/pdf/2023057048ioc.zip [建議措施] 1 清查並移除所有已確認存在惡意威脅之瀏覽器擴充功能。 2 清除瀏覽器快取、Cookie及相關會話資料，避免持續的憑證洩漏風險。 3 持續監控受影響主機及相同網段的網路行為，確保異常活動不再復發。 4 如懷疑帳號憑證已外洩，請強制重設相關使用者密碼及多因素驗證設定。 Forwarded National Security Information Sharing and Analysis Center NISAC-400-202507-00000048 [Content Description] The National Security Administration has observed external security intelligence and recently discovered that hackers have carried out malicious hijacking activities against browser extensions (such as the Red Direction activity). Their attack method is to use legitimate extensions to implant malicious code in subsequent updates, which can monitor user web browsing activities and send them to C2 servers, and even lead to phishing websites. Scope of impact: Chrome and Edge have a total of 18 extensions, which may cover more than 2.3 million users. Detailed list download link: https://cert.tanet.edu.tw/pdf/2023057048ioc.zip [Recommended measures] 1 Check and remove all browser extensions that have been confirmed to have malicious threats. 2 Clear browser cache, cookies and related session data to avoid the risk of continuous credential leakage. 3 Continue to monitor the network behavior of the affected host and the same network segment to ensure that abnormal activities do not recur. 4 If you suspect that the account credentials have been leaked, please force reset the relevant user passwords and multi-factor authentication settings.
相關訊息
公告時間	2025/7/28 至 2026/1/28	點閱次數	131