Researchers link 60 OffiDocs extensions to URL harvesting

Sixty OffiDocs Chrome extensions have been linked to 2.3 million installs after researchers at Bay Area Labs traced a single Estonian company as their common hub. The extensions cover office tools such as editors for Word, Excel, PowerPoint and PDF, plus a free VPN. The group found that 37 of the extensions hex-encode and exfiltrate the full URLs users visit, a technique that can evade some browser reviews and data-loss prevention tools.

The extensions sit under four publisher accounts – officeonlinesystems, RedcoolMedia, ApkOnline android online and RunApps – and the researchers note additional add-ons exist for Firefox, Edge and China’s 360 store.

How the URL harvesting works is that each extension creates a unique user ID during installation. It hex-encodes the URL of every page a user visits and sends it, together with the user ID, to servers linked to OffiDocs. The researchers say the hex encoding matters because Chrome Web Store review and many DLP tools do not flag such URLs, potentially allowing ongoing collection without obvious detection.

Server responses can also trigger tab redirects; if a reply contains a 302 status, the extension swaps the user’s current page for one of its own choosing, with timing dictated per user and per URL.

Weak disclosure is a theme. Some extensions display a popup disclaimer, but the researchers argue that is not equivalent to explicit user consent, while privacy policies permit data sharing with service providers and partners. RunApps’ Image Downloader Professional Premium is singled out for giving no notice of URL collection, and its policy reportedly makes no mention of passively collecting every visited URL.

The piece also flags VPNOnline, a free VPN cited as having around 20,000 users, which reportedly downloads a keyword list hourly and reports any visited URL containing a keyword, with traffic relayed through eight proxies and shared login credentials, undermining user privacy. The report links these practices to OffiDocs through shared code, contact details and server endpoints, though the exact data destinations remain unclear.