Approximately half an hour ago, I became aware that the version of Oracle distributed on the Chrome Web Store contained code that logged usernames and passwords on login, at the very least. (I’m not near a laptop and haven’t done a full code diff).
Oracle has been unpublished so it should be disappearing, but uninstall it NOW.
This code isn’t present on GitHub or v0.1.8, the last update I pushed out. The current compromised version is “v0.1.9” and Chrome Webstore says it was pushed on 10/3/17.
If you have used Oracle since then, you need to CHANGE YOUR PASSWORD NOW. If you have used this password on another site, you need to change it as well.
The extension is permissions wise scoped to Epicmafia.com, so any activity on any other site should not be affected.
At this moment I do not know how my account was breached and the compromised extension uploaded, nor do I know how access to Epicmafia.net was accessed (if at all). I will update in this thread as I further investigate.
If you see someone is not responding you have to keep messaging. Otherwise they show disrespect. You were disrespecting me and ignoring me when i wanted to help.
This is what I’m looking into as well. My Google account is pretty high value. Obviously I’m limiting details I share as my account has apparently been compromised. (There are no other IoC, or unrecognised devices in my account history, but something from early October probably wouldn’t appear now).
