We found that CacheFlow would carry out its attack in the following sequence:Дistribution of Avast users that installed one of the malicious extensions We believe they tried to solve two problems, command and control and getting analytics information, with one solution. In addition, it appears to us that the Google Analytics-style traffic was added not just to hide the malicious commands, but that the extension authors were also interested in the analytics requests themselves. We alerted both Google and Microsoft about the presence of these malicious extensions on their respective extension stores and are happy to announce that both companies have since taken all of them down as of December 18, 2020.Д¬acheFlow was notable in particular for the way that the malicious extensions would try to hide their command and control traffic in a covert channel using the Cache-Control HTTP header of their analytics requests. We described a huge campaign composed of dozens of malicious Chrome and Edge browser extensions with more than three million installations in total. This blog post brings more technical details on CacheFlow: a threat that we first reported about in December 2020. But that is not always the case as we recently found. We usually trust that the extensions installed from official browser stores are safe.

Chances also are your web browser has various extensions that provide additional functionality. Chances are you are reading this blog post using your web browser.

Avast threat has been detected sound