Netflix Party Cookie Stuffing Rogue Extension
Netflix Party is the name of a rogue browser extension for Chrome that offers the ability to watch streaming shows in sync with friends. The malicious icing on the cake is that the same extension also performs cookie stuffing in your Chrome browser.
Netflix Party is a name shared in some variation of the spelling by several other extensions on the Chrome Web Store. The known rogue extension has the store ID of "mmnbenehknklpbendgmgngeaignppnbe". The ID is the string of characters that follows the last forward slash in the Chrome Web Store URL of the respective extension.
The extension modifies cookies from online stores, sticking inside them the affiliate ID string of the rogue extension operators. This means that every purchase made on a system that has the extension installed will generate affiliate payouts for the makers of the extension.
The Netflix Party extension also includes a delayed start time check. The malicious functionality will only be triggered once 15 days have passed since the installation date, which is an attempt to prevent automated analysis of any possible malicious behaviors.
The Netflix Party extension managed to accumulate around 800 thousand users and should serve as a warning to everyone who likes to install seemingly cool extensions on a whim, as they can hide potential malicious components, sadly even if listed on the official Chrome Web Store for a period of time.
