{
	"id": "d5647688-96da-49f1-b64c-0819400745ab",
	"created_at": "2026-04-06T02:11:28.761059Z",
	"updated_at": "2026-04-10T03:21:47.27547Z",
	"deleted_at": null,
	"sha1_hash": "e261d9d268825f6d5a85fe8cc776bb7cf69b65a1",
	"title": "First Chrome extension with JavaScript Crypto Miner detected",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 113224,
	"plain_text": "First Chrome extension with JavaScript Crypto Miner detected\r\nBy Martin Brinkmann\r\nPublished: 2017-09-19 · Archived: 2026-04-06 01:29:20 UTC\r\nGoogle's automatic verification system for Chrome extension uploads to the official Chrome Web Store is a\r\nwreck; less than a day after the Steam Inventory Helper incident, another Chrome extension was found to abuse\r\nuser trust by using user systems for crypto currency mining.\r\nThe most recent version of Steam Inventory Helper transfers any page a user visits in Chrome to a third-party\r\nserver. The free browser extension SafeBrowse on the other hand runs a crypto mining module in the background\r\nwhile it is enabled in the browser and while the browser is open on the system.\r\nSafeBrowse's main purpose is to skip forced intermediary advertising pages from services such as adf.ly or\r\nLinkbucks.\r\nThe most recent update of the browser extension includes a crypto miner that runs in the browser automatically. It\r\nuses the computer's processing power -- CPU -- to mine cryptocurrency.\r\nChrome users who have installed the browser extension may have noticed that CPU usage is going up whenever\r\nChrome is open. Those with proper firewall protection may have noticed that connections are made to the domain\r\ncoin-hive.com.\r\nA quick look at the source code of the Chrome extension SafeBrowse confirms that connections are made to the\r\nsite.\r\nhttps://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/\r\nPage 1 of 3\n\nThe rise of in-browser crypto mining seems inevitable.  One of the longest standing torrent indexing sites, The\r\nPirate Bay, was found to run a crypto miner on its website as well this month.\r\nTorrentfreak broke the story, and a quick analysis of the Pirate Bay's code revealed that it too used the JavaScript\r\nminer provided by Coin Hive.\r\nNow it is the first Google Chrome extension that mines crypto currency while the extension is installed, and it\r\nseems likely that it won't be the only one that will make use of such an option.\r\nWhile there is nothing wrong with crypto mining in the browser, other than that it is highly ineffective as it relies\r\nsolely on the processor, it becomes a huge issue if the mining is not user initiated but enforced automatically either\r\non visit or when an extension is installed.\r\nThe first anti-mining browser extension was released recently. No Coin is designed to block known mining\r\ndomains, but it may not work properly if the mining comes from an extension and not from a website.\r\nAnyway, if you have installed SafeBrowse for Chrome, it is probably a good idea to uninstall the browser\r\nextension at this point in time.\r\nGoogle needs to change its stance on the store's verification process for new extensions and extension updates.\r\nMozilla, a much smaller organization, does this a lot better as it has a manual review policy in place for all new\r\nand updated Firefox extensions.\r\nhttps://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/\r\nPage 2 of 3\n\nSource: https://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/\r\nhttps://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/"
	],
	"report_names": [
		"first-chrome-extension-with-javascript-crypto-miner-detected"
	],
	"threat_actors": [],
	"ts_created_at": 1775441488,
	"ts_updated_at": 1775791307,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e261d9d268825f6d5a85fe8cc776bb7cf69b65a1.pdf",
		"text": "https://archive.orkl.eu/e261d9d268825f6d5a85fe8cc776bb7cf69b65a1.txt",
		"img": "https://archive.orkl.eu/e261d9d268825f6d5a85fe8cc776bb7cf69b65a1.jpg"
	}
}