Hackers have targeted Google Chrome users in a frightening attack with dozens of browser extensions compromised with malicious code—here’s what we know so far.

Criminals have hijacked dozens of popular browser extensions in a bid to target Google Chrome users and steal sensitive data, like passwords. The devastating campaign started last month and shows no sign of slowing.

A new attack campaign has targeted known Chrome browser extensions, leading to at least 35 extensions being compromised and exposing over 2.6 million users to data exposure and credential theft. The attack targeted publishers of browser extensions on the Chrome Web Store via a phishing campaign and used their access permissions to insert malicious code into legitimate extensions in order to steal cookies and user access tokens.