1 Million Browsers Secretly Turned Into Scraping Bots
▼ Summary
– Nearly 1 million devices have installed 245 browser extensions that bypass security protections to scrape websites for a paid service.
– The extensions, available for Chrome, Firefox, and Edge, use the MellowTel-js library to monetize by enabling web scraping for advertisers.
– MellowTel is linked to Olostep, a company offering web scraping services that evade bot detection and handle large-scale requests.
– Researchers found that Olostep likely distributes scraping tasks to extensions running MellowTel, turning users’ browsers into scraping tools.
– MellowTel’s founder claims the library shares users’ bandwidth for accessing public data, with developers receiving 55% of the revenue.
Nearly one million web browsers have been covertly transformed into data-scraping tools through seemingly harmless extensions, according to new security findings. These add-ons, available across Chrome, Firefox, and Edge, disguise themselves as productivity tools, bookmark managers, volume boosters, and random number generators, while secretly executing scraping operations for third-party clients.
Security researcher John Tuckner identified 245 compromised extensions with a combined 909,000 downloads, all linked to a JavaScript library called MellowTel-js. Marketed as a monetization tool for developers, the library allegedly bypasses browser security protocols to harvest web data on behalf of paying customers, including advertisers.
The scheme’s mechanics reveal a troubling partnership. Tuckner traced connections between MellowTel and Olostep, a company offering a “web scraping API” that claims to evade bot detection while processing 100,000 requests per minute. Clients submit target URLs, and Olostep allegedly routes these tasks through browsers running the compromised extensions.
Analysis of MellowTel’s code suggests the library funnels scraping requests to active extensions, effectively turning users’ devices into unwitting proxies. While the library’s founder defends it as a “bandwidth-sharing” service that avoids ads or data collection, critics argue it undermines privacy by exploiting browser permissions. Developers reportedly earn 55% of revenue, with the remainder going to MellowTel.
This incident highlights the risks of third-party extensions, even those masquerading as benign utilities. Users are advised to audit installed add-ons and remove any linked to suspicious libraries. Meanwhile, the discovery raises broader questions about the ethics of monetizing browser access without explicit consent.
(Source: Ars Technica)
