Browser extensions turn nearly 1 million browsers into website-scraping bots

Attempts to reach MellowTel representatives were unsuccessful.

Tuckner’s discovery is reminiscent of a 2019 analysis that found browser extensions installed on 4 million browsers collected users’ every movement on the web and shared them with customers of Nacho Analytics, which went defunct shortly after Ars exposed the operation.

Some of the data swept up in the collection free-for-all included surveillance videos hosted on Nest, tax returns, billing invoices, business documents, and presentation slides posted to, or hosted on, Microsoft OneDrive and Intuit.com, vehicle identification numbers of recently bought automobiles along with the names and addresses of the buyers, patient names and the doctors they saw, travel itineraries hosted on Priceline, Booking.com, and airline websites, Facebook Messenger attachments and Facebook photos, even when the photos were set to be private. The dragnet also collected proprietary information belonging to Tesla, Blue Origin, Amgen, Merck, Pfizer, Roche, and dozens of other companies.

Tuckner said in an email Wednesday that the most recent status of the affected extensions is:

• Of 45 known Chrome extensions, 12 are now inactive. Some of the extensions were removed for malware explicitly. Others have removed the library.
• Of 129 Edge extensions incorporating the library, eight are now inactive.
• Of 71 affected Firefox extensions, two are now inactive.

Some of the inactive extensions were removed for malware explicitly. Others have removed the library in more recent updates. A complete list of extensions found by Tuckner is here.

Update, Thursday, July 10: MellowTel founder Arsian Ali contacted Ars after this post went live. He has publshed a detailed response here. The description of the MellowTel customer base has been corrected.