Executive Summary
Security researchers have identified a large-scale operation named RedDirection that compromised over 2.3 million users of Google Chrome and Microsoft Edge. The campaign involved 18 previously benign and highly-rated extensions—including tools like 'Color Picker, Eyedropper – Geco colorpick' and various volume boosters—that were updated with hidden Trojan components. Because these updates occurred through official browser stores, the malicious code was silently installed without user interaction.
The weaponized extensions functioned as surveillance malware, capturing every URL visited and communicating with a remote command-and-control (C2) server. This infrastructure allowed attackers to redirect users to phishing sites, prompt fraudulent software updates, and maintain long-term persistent access to compromised environments. While the extensions have been removed from official stores, dormant 'sleeper' extensions and active attacker infrastructure remain a significant threat.
For enterprises, this campaign highlights a critical supply-chain risk where trusted productivity tools can become attack vectors overnight. Compromised corporate devices could lead to credential theft, session hijacking, and targeted internal phishing. Immediate remediation, including extension audits and clearing browser artifacts, is required for affected organizations.