Anatomy of a Brand Impersonation on the Chrome Web Store

By Guy Ushomirsky, Factor Security Research · 14 Jan 2026

Security vendors are, by nature, an attractive target for impersonation: users are primed to trust anything that looks like a protective tool, which makes a convincing fake more dangerous than an ordinary knockoff. Factor's research team recently identified a Chrome Web Store listing built to do exactly that — imitate an established security product closely enough to pass a casual glance.

1. A Familiar Name, a Different Vendor

   The listing used a name and visual identity close enough to a known security brand that users searching for the legitimate product were likely to install the wrong one. Nothing about the listing disclosed that it was unaffiliated with the brand it resembled. For a security-adjacent product, that ambiguity is the entire attack: the user believes they are adding protection, when in fact they have installed software with no vetting history and no accountability to the brand they trusted.

2. Why Look-Alike Extensions Carry Outsized Risk

   Browser extensions typically request broad permissions — the ability to read and modify page content, intercept network requests, and access browsing activity across every site the user visits. A legitimate security extension needs that access to function. An impersonator that has acquired the same trust, without the same vetting, has been handed a direct line into the user's browsing session with no independent verification of what it does with that access.

   The more immediate harm is simpler: a user who believes they are protected stops behaving cautiously. A look-alike extension does not need to be actively malicious to cause damage — it only needs to fail silently while the user assumes it is working.

3. What We Did

   Once identified, the listing was reported through the Chrome Web Store's standard channels for trademark and impersonation violations. Factor's team continues to monitor for reappearances under similar names, which is common — impersonating listings tend to resurface under slight variations once the original is removed.

4. Guidance for Users

   Install security software only through links published on the vendor's official site or verified channels, rather than by searching an app store directly. Check the publisher name on any extension listing, not just the product name and icon, and treat a very low review count or a recently created listing as a reason to verify before installing. This pattern is not unique to any one vendor — it is a standing risk anywhere a security brand has enough recognition to be worth copying, and it is the kind of impersonation attempt Factor's research team tracks as part of its ongoing threat monitoring.