You should

parrottalks extension also affected (40k users) kkodiihpgodmdankclfibbiphjkfdenh
t.co/SMFH07Gnv8

Uvoice (40k downloads) also compromised today using uvoice[.]live
oaikpkmjciadfpddlpjjdapglcihgdle
t.co/hGkxieETWj

VPNCity chrome extension also affected chromewebstore.google.com/detail/vpnci... more than 50k users. Using the vpncity[.]live domain

Other domains that that might targeting other chrome extensions:
bookmarkfc[.]info
vpncity[.]live
castorus[.]info
parrottalks[.]info
primusext[.]pro
censortracker[.]pro
uvoice[.]live
iobit[.]pro
moonsift[.]store
yujaverity[.]info
wayinai[.]live
readermodeext[.]info
policyextension[.]info

There is code to receive commands from the malicious domain:

including internxtvpn[.]pro
The extension dpggmcodlahmljkhlmpgpdcffdaoccni - Internxt VPN chromewebstore.google.com/detail/inter... was updated December 25th that added a new content script that runs on every url (cont)

Regarding the Cyberhaven chrome extension compromise I have reasons to believe there are other extensions affected. Pivoting by the ip address there are more domains created within the same time range resolving to the same ip address as cyberhavenext[.]pro (cont)

Google IS dancing

See you in Baides Austin next week.