Cybersecurity is often perceived in a highly formal, checkbox way: a mandatory line item in the budget, insurance against an attack, or an extra task for the IT team. But for SMBs, this approach doesn’t work well. As a company grows, so does its dependency on digital technology, which increases the number of potential entry points for attackers. Cloud services, business applications, extra devices for new hires: all of this generates new risks. Eventually, the question of how much to invest in cybersecurity gives way to a different one: how can it help the business grow without putting extra strain on the budget and staff? That’s the point where cybersecurity stops being just defense against threats, and instead becomes a driver of business growth.

The cost of a mistake

According to the new Global Kaspersky B2B Market Pulse survey, 86% of SMBs were hit by at least one cyberincident last year, while 25% of those incidents resulted in financial losses and business downtime. And it’s not always about a sophisticated targeted attack. Often the threat comes from employees’ everyday actions, such as using unverified software, personal devices, third-party AI services, or weak passwords. And since the IT team still has to handle its usual workload, a vulnerability in the infrastructure can go unnoticed for a long time.

At a small company, the fallout from an incident can affect not just a single IT process, but virtually the entire business — with disastrous results: employees can’t get any work done, customers get no services, data becomes unavailable, and the launch of a new project gets delayed. The company is forced to divert resources away from a growth focus to one of recovery. And that’s how an incident turns into a business risk.

More doesn’t mean better

At first glance, the solution seems obvious: if the number of threats keeps going up, businesses just need to deploy more security tools. But SMBs have another limiting factor: resources. In many companies, one small IT team juggles infrastructure, applications, cloud services, employee devices, and technical support. Cybersecurity becomes just another task on the list, often without a matching increase in headcount or expertise.

According to the mentioned survey, SMB and mid-market IT and security professionals themselves point out several internal constraints: a shortage of incident responders, heavy workloads on IT teams, delayed security investments, and rapid growth in the number of devices and services in use. This can create a vicious cycle: the business grows, the IT environment gets more complex, security becomes harder to manage, risks pile up, and security investment keeps getting pushed back until an incident finally happens.

An ounce of prevention is worth a pound of cure

After detecting an attacker in their infrastructure, companies typically scramble to reinforce several areas all at once: employee training, device security, monitoring, cloud security, and so on. According to the survey, оn average, businesses take action across 4.5 areas after an incident. This approach has an obvious drawback: the organization first suffers the consequences, and only then figures out what kind of protection it was missing in the first place. In other words, cybersecurity ends up being a reaction to something that’s already happened.

A more sustainable approach is to evolve a corporate security posture gradually and in sync with the business, anticipating changes in its infrastructure and processes. It’s not necessary to predict every possible threat. It’s enough for the IT team to regularly ask themselves a few practical questions:

• Which technologies and systems does our business depend on today?
• What’s changed in our IT environment?
• Where are the biggest risks right now?
• What can our team realistically keep under control?
• What new security requirements will emerge at the next stage of growth?

Two paths for evolving corporate cybersecurity

When a company focuses on steadily building up its cybersecurity posture, two paths open up: raising its existing level of protection, and expanding coverage to address risks tied to new business needs. A business can pursue either path on its own or combine them.

Path 1: hardening protection

As a business and its security requirements mature, a company can move to more advanced levels of protection and, if needed, bring in managed services’ expertise. That’s exactly the approach behind Kaspersky Next Optimum — an offering for growing SMB and mid-market businesses. A small company may start with Kaspersky Next EDR Foundations, and later move up to the next protection tiers — EDR Optimum, XDR Optimum, or, if managed protection is needed, MXDR Optimum — as its security maturity grows.

Path 2: expanding coverage

Sometimes a company doesn’t need to move to a fundamentally different level of protection. It needs to solve a specific problem that came up as the business grew. For example, the company might ramp up its use of cloud infrastructure, discover that employees have become a major source of risk, or find itself needing to manage vulnerabilities systemically. In such cases, protection can be extended with Security Modules . They’re compatible with Kaspersky Next Optimum, and allow IT teams to cover specific needs as they emerge without having to replace the existing security foundation. Here are the key capabilities of each module:

• Security Awareness helps reduce risks tied to the human factor, and turns employees into an extra layer of defense.
• Email Security strengthens the protection of corporate communications and sensitive data against threats that spread through email.
• Workload Security helps protect cloud and hybrid environments as businesses shift more of their workloads to the cloud.
• Vulnerability Management lets IT teams identify and prioritize vulnerabilities to address them before attackers get the chance to exploit them.
• Threat Lookup & Analysis provides extra context when investigating suspicious files, objects, and threat indicators.

Cybersecurity as a process: the benefits

Small and medium-sized businesses shouldn’t treat cybersecurity as a target to be reached and roll out every possible security tool all at once. It’s far more practical to treat it as an ongoing process closely tied to the company’s growth. This approach helps solve several problems simultaneously:

1. Maintain business continuity. The sooner a threat is detected and stopped, the less likely it is to turn into a serious incident that disrupts the company’s operations. Protecting against threats, catching them early, and responding promptly all help lower the risk of downtime, and keep business processes running smoothly.
2. Make the most of limited resources. Careful planning of corporate security strategy goes hand in hand with process automation, centralized visibility, and investigation tools. These, in turn, help cut down on routine tasks, and free up resources for what really matters.
3. Build a foundation for future growth. By strengthening security as the business grows, the company builds a solid foundation for whatever comes next — whether that’s workload protection, more advanced vulnerability management, or deeper threat analysis. There’ll be no need to rebuild the defenses from scratch each time new business processes emerge.

Ultimately, well-built cybersecurity is more than just a tool for prevention and response. It’s what lets a company keep working despite a constantly growing number of threats, adopt new technology, seize new opportunities, and grow. Visit our website to learn more about how the Kaspersky Next Optimum and Security Modules help growing companies build protection that matches their current needs.

Malicious extensions and ClickFix attacks are two hugely popular topics on our blog, and for a good reason: they’re both very common. In this post, we bring them together. Here’s the thing: in our posts about malicious ClickFix instructions, we don’t always explain exactly how users end up on the attackers’ pages in the first place. A recent study gives us a chance to fill that gap and talk about one of those methods: malicious extensions.

Readers who are not deep into cybersecurity may already have a bunch of questions at this point: how can extensions be malicious? where do they come from? and what exactly is ClickFix, anyway? Fret not: this post answers all these questions.

The danger of browser extensions

Let’s start with the basics. Browser extensions or add-ons are lightweight tools installed in your browser to give it extra capabilities or change how it works with web pages. For example, extensions can block ads, translate pages, download audio and video, save passwords, or take screenshots.

Most browser developers offer users an official extension store. For instance, for the most popular browser, Chrome, that store is the Chrome Web Store. There are also alternative platforms for distributing extensions, though browser developers have recently made it much harder to install and use extensions that don’t come from an official source.

Just like any other software, extensions can be useful, but they can also be malicious. In fact, cybercriminals often spread malicious extensions through those very same official stores, and we’ve covered plenty of such cases on our blog before.

It’s no accident that criminals love spreading malicious plug-ins. To work properly, most extensions need permission to read and modify the content of every web page the user visits. Without that permission, add-ons would be basically useless. For instance, a translation extension needs to read all the text on a page before it can swap the original for the translation.

Cybercriminals take advantage of these capabilities for their own purposes: for example, they intercept logins, passwords and other data entered on websites, swap out payment details, or show victims fake forms and messages. And all of this happens on legitimate sites that users have come to trust without a second thought.

Now let’s move on to a fresh piece of research about a campaign that spread 19 malicious add-ons through the Chrome and Edge extension stores. We’ll use it as an example to look at what these tools can actually do.

Almost twenty malicious extensions for Chrome and Edge

In late August, cybersecurity researchers reported finding 18 malicious extensions for Chrome and one for Edge. They said all 19 add-ons were probably linked to the same campaign. They base this on the similarity of the malicious code and the methods the attackers used. You’ll find the full list of malicious extensions at the end of this post.

Most of the extensions discovered, 14 in total, were built by the attackers themselves. Their first versions weren’t malicious at all and did exactly what users downloaded them for. But after a while, once users had come to trust the add-on, the attackers pushed an update that slipped in malicious functionality.

As for the remaining five extensions, their creators had nothing to do with the cybercriminals at all. They simply sold their creations to them. This way of getting hold of extensions is also popular among cybercrooks. There are plenty of reasons for that: ready-made add-ons can be bought for relatively little money, and criminals don’t have to build or promote them from scratch. And most importantly, along with the extension, they also inherit its existing user base. Upon buying the add-on, all the attackers need to do is add malicious functions and push an update that installs automatically for users. Users are never told that the extension’s real owner has changed.

In this case, the add-on cybercriminals bought most often was Enable Right Click & Copy — Smart Unlock + OCR. It had 70 000 users in Chrome and 10 000 in Edge. This purchase is exactly why there’s a single Edge extension among all its Chrome relatives. The add-on itself originally served a perfectly benign purpose: it let users select and copy text on sites where that’s normally blocked, and it could also pull text out of images with optical character recognition (OCR).

The malicious functionality introduced into the extension makes it reach out to the attackers’ command-and-control (C2) server to download additional modules of nefarious code. These modules can change over time. Since Chrome automatically updates all installed extensions by default, the malicious version lands on the device without users having to do anything at all.

For the downloaded code to run on the websites the user visits, the extension disables one of their defenses — Content Security Policy (CSP). This mechanism allows website owners to declare which scripts and other resources are allowed to load and run on a page. Once this protection is turned off, the extension can inject code it gets from the C2 server right into the pages open in the browser. The website itself isn’t hacked, and it looks the same to everyone else, but for that one infected user, the legitimate page quietly turns malicious.

What these 19 extensions can do

Now let’s take a closer look at what the malicious modules loaded by the extension are actually capable of. Researchers found 16 such modules, built for all sorts of tasks: from stealing data and hijacking cryptocurrency to the ClickFix attacks we’re focusing on here.

Some of the modules simply collect user data. They intercept logins, passwords, email addresses, and other valuable information the user enters into web forms, including payment details. On top of that, the add-ons steal data from Facebook and LinkedIn accounts and collect browsing history. Criminals can use this information to take over accounts, steal money, and launch further attacks against the victim.

A few other modules focus specifically on stealing cryptocurrency and related data directly. One of them is a crypto drainer, a tool that empties crypto wallets. It works with Ethereum and compatible blockchains as well as Solana and Tron. It replaces the real Connect Wallet and Swap buttons on websites with its own fake ones. When a user clicks one of these buttons, the drainer takes over all further interaction with the wallet and walks the victim through confirming the actions needed to steal their cryptocurrency.

Other modules target users of Ledger and Trezor hardware wallets. Right on the official websites of these services, the malicious extension displays a fake wallet update-and-restore page that asks for a seed phrase of 12, 18, or 24 words. The seed phrase the user enters is forwarded straight to the attackers, giving them full control over the wallet.

Finally, some modules gather information from crypto service pages open in the browser, such as OKX, MEXC, Kraken, KuCoin, Coinbase, Binance, Bybit, and MetaMask, including balance details and active session data that can be used to hijack accounts.

And now we’ve finally reached the module that matters most for this post: the one used for ClickFix attacks. We’ll talk about it in the next part.

How malicious extensions are used in ClickFix attacks

The ClickFix attack technique has become extremely popular among cybercriminals lately. It relies on social engineering: the victim is shown fake instructions supposedly needed to complete some action, such as passing a CAPTCHA check, fixing an error, or updating a program. Following these instructions, the user copies the command suggested by the attackers, pastes it into a system tool built for running these commands, and runs it, all by themselves.

We’ve written about attacks like this and their consequences more than once on our blog. But we rarely dig into exactly how a victim ends up on a page with fake instructions in the first place. A campaign that spread malicious extensions through the Chrome Web Store shows us one way this can happen.

Add-ons turn out to be a very handy tool for ClickFix attacks. As we mentioned earlier, when a user visits a page, extensions are allowed reading and changing its content in order to work. That gives attackers the chance to swap in a fake ClickFix instruction at just the right moment, replacing the content of the page the person actually wanted to open.

What’s more, the ClickFix technique itself lets attackers break out of the browser and gain a foothold directly in the system. That means removing the malicious extension won’t necessarily undo the damage: after the user has run the ClickFix command, malware may already be installed outside the browser.

In the specific attack example the researchers describe, the user sees a fake notification saying their browser needs to be updated, along with instructions on how to do it. The instructions change depending on the operating system, and the extension picks up that information automatically too.

How to avoid falling victim to infected extensions

First off, we recommend checking whether any of the following malicious extensions are already installed in your browser:

• Enable Right Click & Copy — Smart Unlock + OCR
• RapidLens – Google Lens for Screen Search & Images
• QuickLens – Search Screen with Google Lens
• Password Protect PDF
• Allow Copy – Select & Enable Right Click
• PixelCheck
• Creative Library – Ad Spy Tool
• Website Traffic Checker: MirrorSphere SEO Stats
• Site Signal – Website Traffic & SEO Checker
• SEO Pulse Pro – Website Traffic & SEO Analyzer
• Private Crypto News Reader
• Blockfolio: Address Monitor
• Crypto Rates & Fiat Converter
• Crypto Alerter: Price Alarms & Volatility Warnings
• DeFi Pulse Tracker
• Crypto Price Badge: Quick Glance
• Multi-Chain Explorer
• LedgerLook: Wallet Checker
• Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Ray

If you find any of these extensions on your device, we recommend removing it as soon as you can and running a full system scan with a reliable antivirus. As we mentioned above, simply deleting the add-on might not be enough. You can use a free trial version to detect and remove the infection.

How to avoid falling victim to malicious extensions and ClickFix attacks in the future?

• Don’t install too many extensions and regularly check the list of those you have.
• Remove extensions you don’t use.
• Trust the warnings from your operating system and security software, rather than the instructions — or even the demands — of websites and apps.
• Install a trusted security solution on all your devices.

What else makes browser extensions and the ClickFix technique dangerous? Find out in our other posts:

• Bad advice for gamers: ClickFix hits Steam forums
• ClickFix on macOS: how Apple users are being scammed
• Infostealer has entered the chat
• AI sidebar spoofing: a new attack on AI browsers
• Dangerous browser extensions