2024 Cyberhaven — Chrome Web Store account takeover; malicious extension build (supply chain)

Over the 2024 Christmas Eve window, Cyberhaven publicly confirmed threat actors compromised an employee account via a phishing campaign framed as Chrome Web Store developer support, then abused publishing access to ship a trojaned build of Cyberhaven’s Chrome browser extension (reported as version 24.10.4 in industry write-ups). Analysts and Cyberhaven stated the malicious package could harvest browser-session material (e.g., cookies, tokens, user-agent context) with observed targeting narratives around high-value accounts such as advertising platforms. Cyberhaven described rapid detection on December 25, 2024, takedown of the rogue listing, release of a clean build, and coordination with law enforcement; press and vendors situated the incident inside a broader wave of Chrome-extension developer account hijacks affecting many publishers and millions of cumulative installs.