What to look out for today
- Malicious Chrome/Edge extensions that can steal browser data and sensitive information.
- Infostealer malware hijacking logged-in AI sessions (e.g., Claude) to access accounts and run up usage.
- Follow-on scams linked to a UK travel/airport data-theft claim (e.g., fake refunds, itinerary changes, “confirm your booking” messages).
Why this matters to smaller businesses
SMEs rely heavily on browsers for email, banking, payroll, SaaS tools and AI assistants. If a staff member installs a rogue extension or gets infostealer malware, attackers may not need passwords at all—they can reuse active login sessions to get into business systems. Separately, high-profile breach news can be used to craft convincing phishing that targets your staff, customers, or finance team.
Warning signs
- Staff reporting their browser is “acting odd”: new toolbars, pop-ups, redirects, or unexpected prompts.
- Unexpected logins, new devices, or new sessions flagged by SaaS tools.
- Sudden, unexplained usage spikes or charges in AI/SaaS accounts.
- Emails/SMS about travel refunds, flight changes, compensation, rebooking, or verifying passenger details—especially if they pressure quick action.
- Browser extensions that request broad permissions (e.g., access to all sites) with no clear business need.
How attackers may exploit the situation
- Extension-led data theft: a malicious extension can read or tamper with web pages, capture form data, and collect browsing information.
- Session hijacking: infostealers can grab session tokens/cookies so attackers can access accounts as if they were the user, bypassing normal sign-in steps.
- Breach-themed phishing: criminals reuse real news to make messages feel legitimate (e.g., “we’re contacting you about your recent travel booking”).
What to do today
- Ask staff to review and remove unnecessary browser extensions (keep only what’s needed for work).
- Prioritise MFA and session controls on key services (email, finance, payroll, AI, CRM). Where available, enable alerts for new logins/devices.
- Send a short staff note: be cautious with travel/refund/compensation messages; don’t click links—go directly to the supplier’s official site/app.
- Check AI/SaaS admin consoles for unusual usage, new API keys, new devices, or unfamiliar active sessions and revoke anything suspicious.
- Remind finance teams: treat any payment change request or urgent “refund processing” message as high risk and verify out-of-band.
Ask your IT provider
- Can we control/allow-list browser extensions on company devices (or at least report on what’s installed)?
- Do we have infostealer detection in place (endpoint protection) and a process to respond if a device is suspected?
- Which key SaaS tools support session management (view/revoke sessions) and are alerts enabled for suspicious sign-ins?
- What is our playbook if an employee’s browser is compromised (isolation, password resets, token revocation, comms, monitoring)?
Patch watch - only one short paragraph, and only if relevant
Rather than chasing specific vulnerabilities today, focus on browser and endpoint hygiene: keep managed browsers up to date and minimise extensions. The immediate risk in the news is how attackers misuse extensions and stolen sessions, which can succeed even when systems are otherwise patched.
One action today
Ask all staff to remove any non-essential Chrome/Edge extensions today and report any extension they didn’t install themselves.
Related Actions On Cyber resource
CTA: Use the Actions On Cyber “Phishing & payment-change verification” checklist (quick steps for staff and finance teams).
Sources
- Chrome Web Store extensions caught stealing crypto, browser data (BleepingComputer)
- Anthropic warns infostealer malware is hijacking Claude sessions to drain usage (BleepingComputer)
- FulcrumSec claims Manchester Airports hack, theft of 86 GB of data (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.