JSON Formatter Chrome Extension carrying a malware payload

By admin, Fri, 07/03/2026 - 09:36

Recently, my automatic Malwarebytes scan on my Windows 11 laptop came back with 21 detections. Not the kind of number you want to see!

Turned out the culprit was JSON Formatter, a small Chrome extension (ID bcjindcccaagfpapjjmafapmmgkkhgoa) I'd had installed for years as a basic dev tool — auto-pretty-print JSON in the browser tab, nothing exciting. Malwarebytes flagged it as PUP.Optional.Hijacker across its install folder, its entries in Chrome's Preferences/Secure Preferences files, and its Sync Data LevelDB. Same extension, 21 filesystem fingerprints.

What actually happened

Apparently the extension didn't start out malicious. It shipped as a legitimate open-source tool. Somewhere along the way — a change of maintainer email, a version bump that quietly added webRequest and unlimitedStorage permissions — it turned into something else. Recent versions inject a script onto pages (including checkout flows) that pops up donation solicitations for something called "GiveFreely," and phones home to api.givefreely.com and events.givefreely.com for tracking. It also queries a geolocation API on page load. None of that has anything to do with formatting JSON.

This is the classic extension supply-chain problem: you install something small and useful, grant it broad permissions because that's normal for a dev tool, and then trust it indefinitely because updates are silent and automatic. Nobody re-reviews a four-year-old extension's permission list. The extension doesn't need to be malicious on day one — it just needs to still be installed on the day it becomes malicious.

The fix

Removed it from chrome://extensions, re-ran the scan, came back clean. No process, registry, or rootkit hits at any point — just the extension artifacts — so there was no secondary payload to chase down. The one thing worth checking afterward: if Chrome sync is on, the extension may have propagated to other machines signed into the same Google profile, so it's worth a manual check everywhere, not just the machine that triggered the scan.

How to remove the extension from Chrome

Via chrome://extensions:

Go to chrome://extensions
Find the extension (i.e. JSON Formatter), click Remove, confirm
Restart Chrome
If Sync is on, check other machines under the same Google account — repeat there

Via the toolbar puzzle icon:

Click the puzzle-piece icon (Extensions) in the toolbar, right of the address bar
Find the extension (i.e. JSON Formatter) in the dropdown list
Click the ⋮ (three-dot menu) next to it
Select Remove from Chrome, confirm

Same end result either way — the puzzle-icon route just skips loading the full extensions page.

The actual takeaway

Malware isn't always something you download by mistake. Sometimes it's something you installed correctly, years ago, that got taken over later. Extension permission changes are visible in most extension detail pages and stores — a JSON formatter suddenly requesting webRequest is a signal worth noticing, not something to auto-approve because "it's just an update."

Worth an occasional five-minute audit of what's actually still installed in your browser, and why.

For more

Pluto Security — Chrome Extension Supply Chain Attacks: How Ownership Transfers Enable Silent Permission Creep — best explainer of the attack chain stages and why permission creep goes unnoticed
The Hacker News — Chrome Extension Turns Malicious After Ownership Transfer — the QuickLens/ShotBird case, Annex Security's John Tuckner quoted directly on the pattern
SN-1064 — "How secure are your Chrome extensions and certificate signings really?" — covers a large spyware discovery via extensions plus the code-signing identity problem for developers

Malwarebytes showed

Folder: 3
PUP.Optional.Hijacker, C:\USERS\SELWY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\BCJINDCCCAAGFPAPJJMAFAPMMGKKHGOA, No Action By User, 8539, 1394747, 1.0.111690, , ame, , , 
PUP.Optional.Hijacker, C:\USERS\SELWY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Local Extension Settings\bcjindcccaagfpapjjmafapmmgkkhgoa, No Action By User, 8539, 1394747, 1.0.111690, , ame, , , 
PUP.Optional.Hijacker, C:\USERS\SELWY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 8539, 1394747, 1.0.111690, , ame, , ,

File: 18
PUP.Optional.Hijacker, C:\USERS\SELWY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 94A961F1DE16CA47759F997048FABD34, 0F6BC2CCC2135240D3E30A36ECD7465EB889F6861442F5CD73322F8DB2B7A884
PUP.Optional.Hijacker, C:\USERS\SELWY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, No Action By User, 8539, 1394747, 1.0.111690, , ame, , AD51908CDB1ACA483A91A9FACEBAF348, C6BEFA6634A8B54FFAD9701074EBE7C37E57010F989DE03CA89ABD661ACD291B
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcjindcccaagfpapjjmafapmmgkkhgoa\000003.log, No Action By User, 8539, 1394747, 1.0.111690, , ame, , D41D8CD98F00B204E9800998ECF8427E, E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcjindcccaagfpapjjmafapmmgkkhgoa\CURRENT, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcjindcccaagfpapjjmafapmmgkkhgoa\LOCK, No Action By User, 8539, 1394747, 1.0.111690, , ame, , D41D8CD98F00B204E9800998ECF8427E, E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcjindcccaagfpapjjmafapmmgkkhgoa\LOG, No Action By User, 8539, 1394747, 1.0.111690, , ame, , AC2DB8B536E408ACACE94D97F9D64991, 0DAE738286789036B4833C00AB06A55F35156F3A8A98BD1E2B9F33C20EA561FF
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcjindcccaagfpapjjmafapmmgkkhgoa\LOG.old, No Action By User, 8539, 1394747, 1.0.111690, , ame, , FCCC38141FD6ECB7F6607C4E86898BCC, 698DCCD45877F136928AC31996D69614F4E2B48BC2CA1A4CC0DEDC53688F4F21
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcjindcccaagfpapjjmafapmmgkkhgoa\MANIFEST-000001, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 5AF87DFD673BA2115E2FCF5CFDB727AB, F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000005.ldb, No Action By User, 8539, 1394747, 1.0.111690, , ame, , FA7800AC2540582F8A6C5807F0B27EB9, D1F0CE80BD95581A83C117E10AF84FE36D3E3AF5216E3D91ABFDFB95C0420CD3
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000006.log, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 8A2FC7FE3A644EDFD267D1A1C04EDEE7, B6E3E778479FC9611598CDE70FF5F9DACB034D119F794A260DB2C2778449C4E8
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.ldb, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 15F59C02EB3C5E74238797965CF3F2F3, 5837C29AA9F5AAFC593F5E99CA6FB44670F9CE071B30B20F9DB7B05AC7425248
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK, No Action By User, 8539, 1394747, 1.0.111690, , ame, , D41D8CD98F00B204E9800998ECF8427E, E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 0CD6FEA3B60966FB2EE0FF7486AEFE29, 4E3DEA972303FA51368CFFC0EB9A70936CBACDC23286284439FE68CE76F77128
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 86E8FEDB7216D10FB05EA91F5253D39E, 047F3C5EBE18A1D8E16D53707181A60BC6A76EF038CE4175CAC1DF51D40F0B8D
PUP.Optional.Hijacker, C:\Users\selwy\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 58F51E2269F31482FADBE5E58D892B81, 7BBED5C31ABBC7DE6C57418F36F77542C8208CF211548926EB1F0FEF32D61979
PUP.Optional.Hijacker, C:\USERS\SELWY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\BCJINDCCCAAGFPAPJJMAFAPMMGKKHGOA\0.10.2_0\CONTENT.JS, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 99C7E0BCB6BB56F80322E562214A279A, 93048A5809A1646DABAF8AFF82AC6993590026D84CA9496F91C5664238692FDF
PUP.Optional.Hijacker, C:\USERS\SELWY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\BCJINDCCCAAGFPAPJJMAFAPMMGKKHGOA\0.10.2_0\SET-JSON-GLOBAL.JS, No Action By User, 8539, 1394747, 1.0.111690, , ame, , 566CB2BD4575BC7C4FEE0AF769EFF3B6, 5FCEE97BAF0D37C11593A83E696EF87A33876FE9CC1C6AD89F67E5D99F737555