Over 2.6 million people may have been affected by a massive supply chain attack leveraging over 35 compromised Chrome extensions to take over Facebook Ad accounts.

The attack began after a hacker successfully targeted a Cyberhaven employee via a phishing email that was sent to Chrome extension developers. The employee, believing the email was an official Google contact, clicked the email and input their login credentials on the phishing page.

When Chrome flagged an extension for malware, it triggered hours of cleanup. Learn how to check your extensions, clear malware, and keep your browser secure for the future.

Tech expert Kurt “CyberGuy" Knutsson says hackers are embedding dangerous code in Chrome extensions to steal your data.