Cyberhaven Chrome extension hijacked through OAuth consent phishing
On December 24, 2024 a Cyberhaven employee received a phishing email posing as Chrome Web Store support and authorized a malicious OAuth app, Privacy Policy Extension, which gave the attacker access to the company's Chrome Web Store account. The attacker published malicious extension version 24.10.4 and Cyberhaven disclosed on December 27. Cyberhaven said the employee had Google Advanced Protection and MFA, received no MFA prompt, and did not have their Google credentials stolen; researchers tied it to a wider campaign against extension developers.
- Victim
- Cyberhaven
- Industry
- Technology
- Country
- United States
- Intrusion began
- Dec 24, 2024
- First disclosed
- Dec 27, 2024
- Actor
- Unattributed
- Initial access
- Consent phishing
- Identity control that failed
- Authorization
- MFA
- Present and bypassed
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
OAuth consent grants access without a password or MFA challenge. Admin-controlled app consent policies that block unverified third-party apps from sensitive scopes would have stopped the grant.
Go deeper on SWI
- Technique: OAuth consent phishing
Sources
- Dozens of Chrome extensions hacked in threat campaign, TechTarget, Dec 30, 2024
- Several Chrome extensions compromised in supply chain attack, SecurityWeek, Dec 30, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- UNC6040 voice phishing campaign against Salesforce customers 2025 · Consent phishing
- Midnight Blizzard password spray into Microsoft corporate email 2024 · Password spraying
- LAPSUS$ access to Okta support via Sitel engineer workstation 2022 · Third-party access
- Nobelium abuse of reseller delegated administrative privileges 2021 · Third-party access
Cite this record
SWI Community Team. (2026). Cyberhaven Chrome extension hijacked through OAuth consent phishing. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-cyberhaven-chrome-extension-oauth-consent-phishing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.