Mackenzie Jackson: Hello and welcome to The Secure Disclosure podcast and this is your weekly briefing. Today we're going to be diving into the Honey scandal. If you don't know, Honey is a browser extension that has been enshrined in scandal since about last year when journalist and YouTuber MegaLag first exposed some of their dodgy dealings. Today's story isn't going to be a retelling of the Honey Scandal, though. Instead, I wanted to take you actually behind closed doors and interview the engineer that actually broke the data that became the story. J3lte is an engineer from the Netherlands and after seeing the first video that MegaLag made, he did what engineers do and got curious. He started breaking apart the app and found that actually this story wasn't over. I got to sit down with him and ask him why he started looking into this, what he actually found, and some of the interesting things and processes that he took to be able to discover it, and how he was able to work with journalists like MegaLag to break this story, and also a little bit about what might be coming next.
Just to recap a little bit about what the Honey Scandal is all about. About a year ago, MegaLag published a video that exposed that actually what Honey was doing was applying their own affiliate links. So, how a lot of content creators or advertising companies get paid is by affiliate links. It's when you get a specific link that when you go to a merchant site with that link, then you get a kickback of what was purchased. Well, at the last moment, whether or not they were sent there by Honey or not, the Honey browser extension would insert their own link, often stealing money from a lot of creators. Ironically, creators that they were even working with and paying. So, this exposed Honey from the point of view of the creator. But the recent update actually exposes Honey from the point of view of the user and also the merchant. See, Honey boasted that they had 30,000 participating stores, which you would assume means that out of these 30,000 stores, if you go to them and they're participating, then Honey might have a code for that. Well, actually, there was over 180,000 stores that Honey was trying to apply coupons for. And often the merchants not only didn't know that Honey was doing this, but explicitly didn't want Honey to do this. And the other part comes from the fact that Honey was tracking users and taking an awful lot of data. And this all doesn't sound that bad until you start to apply that Honey was doing this even when they provided no value at all, changing affiliate links when there was no coupon to have and monitoring traffic of all these different users. It's also alleged that they had a mechanism that would try and hide some of their behavior on certain sites. And this particular part was investigated a little bit further from another YouTuber called The PrimeTime. Now, if you want to get deeper into the Honey scandal, there's links below, but that's the abridged version. But as I said, I really wanted to get behind the scenes and tell the untold story about this and what actually happened. So I reached out to J3lte and he very kindly agreed to come onto the show. And the first question that I had obviously was, well, how did you all get involved in this?
J3lte: I got involved after the first video of MegaLag. So I basically, like anyone else, saw the YouTube video and he was talking about Chrome extensions and I know as a software engineer I've built Chrome extensions myself. So I was like, oh, this sounds interesting. And he described how it works, what is happening. And for me that was like, all right, I want to know what is happening behind the scene from a technical side. So when I saw the video, I thought, I'm going to just download the extension and then basically rip it apart and looking for URLs, looking for code and just see how it works. And from there on out, I started building a dataset.
Mackenzie Jackson: And this is what I love about the elusive engineering brain. Instead of trying to figure this out one by one in set examples, J3lte went about measuring the entire system. What is actually happening with your data and where is it going. He set about it like an engineering challenge.
J3lte: When I look at the Chrome extension, I just look at how does it work? So you install it in the browser, you see kind of what is happening. And then for me the most interesting question is where is the data going to and where is it coming from? And so basically you observe that and then you look at the code and that's where I started exploring, like, all right, where is the list of domains coming from? And if I have a domain, what happens next? And so I think the first time I had a bit of a moment was when I saw the list of domains. I was like, this is more than 30,000. This is a whole lot more than 30,000. And that immediately got me interested. I was like, all right, I'm finding this list. Now I need to find out how do I pull the data from from these stores. And that became, yeah, that became a thing.
Mackenzie Jackson: But my favorite part about all of this was when I asked J3lte why he wanted to do this and he gave the most engineering response ever. He was just curious and wanted to pull it apart. So he built some scripts to gather all the data and figure out what it all meant later.
J3lte: When I first downloaded that list of domains, I was like, "All right, I need to find all the store IDs. So I need to write a script to get all the store IDs." Started running that script and it took about, I don't know, three hours or something like that to just only get the store IDs. And that was like, okay, this is interesting. Now I'm going to write a script to get all the data. And that took a whole lot longer. And so, to me, it's the fun of it to build something like that and then get all the data, not even being really interested in what's in the data, but just collecting the data. And then later on, when you start aggregating the data, that's where you have the moments of like, "Oh, wait, what's what's in here? Or what's in here? What's this statistic?" I was like, if I'm committed to something like this, I'm just going to see it through.
Mackenzie Jackson: And once J3lte started pulling in all this data, he started to uncover the essence of what would become the story that the data isn't matching up and the math just isn't mathing.
J3lte: The first question, for example, I had was when MegaLag showed in his video when you go to a store, you see that pop-up and it opens an affiliate link. And now I'm pulling in the data of 180,000 stores. How many have an affiliate link? And that was kind of surprising that you're like, "All right, I have 180,000 stores, but I only have 30,000 affiliate links." And that's where you're like, "Aha, this is interesting." Especially when you put data side by side. When you look at the list of stores that have an affiliate link, there are about 12,000 stores that then don't have coupon codes. So, they do have an affiliate link, but no coupon codes. And you're like, but you're still popping up your Chrome extension. So, you still kind of want that affiliate money while not providing a service.
Mackenzie Jackson: I really want to double down on something that J3lte just said to really understand how it worked from a technical point of view. The Chrome extensions was using a mechanism called pinned tabs to be able to stuff their own affiliate links in, even when an affiliate link had been provided in many cases. And often this was for stores that they weren't providing coupons for and perhaps didn't even have a relationship with Honey. So, in other words, Tiny was providing no value to both the store whom they may not have had a relationship with, and their customer whom they weren't providing a coupon with. Now, aside from the obvious kind of affiliate stuffing links and doing this with stores that you have no relationship with, there is also some other elements at play here. Elements that involve all of the data that Honey is collecting from you, the user of these Chrome extensions. And while this is just an opinion, it does paint a pretty clear picture of why a company like PayPal might be interested in acquiring a company like Honey. Perhaps it's a little bit deeper than just the money Honey gets through affiliate links.
J3lte: Yeah, I know it's huge amounts of data. If you look at the Excel file, you can see how many shoppers they track. So, there is a column there where it says track shoppers, and I think for 30 days that amounted to 290 million. So you have 290 million store visits you track, that's a huge amount of data.
Mackenzie Jackson: One question that I think this has brought up for a lot of people is, well, what are other Chrome extensions doing and how can you tell if a Chrome extension is tracking your data beyond a reasonable amount or doing other dodgy type interference like stuffing links or affiliate links elsewhere? I posed this question to J3lte, but unfortunately there's not a whole lot that you can do.
J3lte: When a user installs a Chrome extension, you do accept the terms and services. I think it's difficult for a consumer to know whether or not your Chrome extension like that is legitimate or not and what it's doing behind the scenes because they're not going to tell you. Honey sends a lot of data to their servers. But if you take, for example, another extension, there are other extensions that will get their data and send their data, but they'll send it in an encrypted way. But the encryption is all done in the extension. So you can reverse engineer it. So the only reason why you're then encrypting it is because you want to hide what you're sending to the server. And to go a little bit deeper into this, whilst some of the functions that Honey is doing is actually described in their terms and services rather loosely, a lot of it actually goes against the terms of services that Google described and what extensions are allowed to do when they're on their marketplace. And in this case, Honey is actually not conforming to all of those. When you look at the Honey extension, you're writing code on the server and you're executing it in your Chrome extension. That's dynamically. When you look at the terms and services of the Chrome web store, that is forbidden. It's against ToS. Google is like, "Nah, we don't care, I guess." So, if there's no transparency and there's also no real enforcement of these terms and services, it's like how can you trust the Chrome extension? When I started researching these extensions, I was like, this is all pretty fishy to me. I understand it provides a certain service to people, but at the same time, there's a lot going on behind the scenes and there's so much data that is tracked of you. And I mean this is all over the internet, right? Google tracks you, other companies track you, but that is usually, in Europe we have rules for that kind of tracking. But when it comes to Chrome extension, you are willfully installing that extension because you want to get a few dollars off here and there. At the meantime, you are paying by just letting a company like that track you everywhere you are on the internet. If nobody says anything, we're not going to do anything. That is how it feels because from the code, you can prove that that type of code is in there.
Mackenzie Jackson: And finally, I had one last question for J3lte, which is what can we expect to come next? Has this scratched his curiosity for the moment or is he diving deeper into various other topics?
J3lte: Yes, Honey got on the radar especially because they did a lot of advertising with YouTubers. I don't know, I like the puzzle, to just get a picture of how does it work? Because in the end, the Chrome extension is kind of like a black box. And yes, you can look at the code and you can kind of pick it apart. But yeah, that's a puzzle you kind of need to solve.
Mackenzie Jackson: That was our main segment for today. And before we get into the other headlines that you need to know in the world of cybersecurity, we have a quick message from our sponsor, Aikido Security. Aikido Security is your complete code to cloud security solution. Securing everything from the first lines of code your developers write all the way to your runtime and cloud environments. I would love to tell you about all its great features like its noise reduction, its breaking change analysis, its autofixing, or even its AI pen testing, but I simply don't have time, but you should check it out yourself at a.dev. Here's what else is happening this week that you need to be aware of. We have a new viral AI assistant in town, Clawbot, spelled C. L. A. W. D. B. O. T. And there's a lot of great examples of people doing some pretty cool things with this. Now, firstly, this is an open-source tool and you can host it locally. Not only does this give you various advantages of being able to create custom use cases for this, it also enables you to be able to sprinkle this into your own projects, your own environments. There is a catch though. Whenever something like this is created and goes viral, you can be sure of one thing, and that is attackers won't miss this trending opportunity. The researchers at Aikido Security have discovered a malicious VS Code extension called Clawbot Agent. The problem is is that Clawbot never actually created a VS Code extension. But if you looked at this VS Code extension, you would be forgiven in thinking it was legitimate. It was polished. It had lots of logos and branding, etc. Not only that, it worked in the exact way that you would expect the Clawbot Agent VS Code extension to work as a coding assistant, but they sprinkled a little something extra in this VS Code extension, and that is a Trojan. What's really unique and clever about this is that the malware that it actually drops isn't actually malware. It's legitimate, which I know sounds a little bit counterintuitive, and it installs Screen Connect, which is a legitimate screen sharing and remote access software, but it does it with a configuration that the attackers can connect to via C2 server. And those of you in operating systems outside of Windows with the .exe file there, don't worry, you're not forgotten. There is also a backup DLL file that tries to do essentially the exact same thing. If you have been a victim to this and you have accidentally installed Clawbot as a VS Code extension, take your computer outside, jump on it, light it on fire, and throw it in a canal. Of course, I'm being a little bit hyperbolic, but if you have installed this, I would really recommend considering yourself to be compromised and do deep thorough cleaning of your machine. If not, do a complete wipe and start to rotate access keys and passwords. Now, while we're on the topic of VS Code, there is another way attackers are using VS Code that's not extensions to try and target developers. Now, this one comes from our friend of the show, Paul McCarty, and the maintainer of open source malware, who has continued his great coverage of the Contagious Interview campaign done by North Korean hacking group and Lazarus. So, if you're not familiar, the Contagious Interview campaign is essentially when North Korean hackers are staging fake interviews with developers to try and get them to run malicious code on their machine as part of, let's say, a coding test. Now, the goal of this is to not only gain access to a developer's machine and try and steal credentials or session tokens that could be very valuable. It's also to try and move laterally into organizations that the developer may work for or potentially in the future will work for, making this really particularly scary. Paul's latest research into how they've been doing this shines a pretty good light of the type of operation that this is. In this case, the fake interviewer will try and get the developer to download code onto their machine that has a malicious font file within it. Yes, you heard that right. It is a fake font file that contains malicious JavaScript. And inside this is some malware written in JavaScript. But essentially what happens here is it auto runs when you open the repository. It then hides your terminal, very sneaky, and then runs Node to open a font file. So this means that if you're looking for malware inside your code, if you're a developer and you're skeptical, you're probably not going to look inside font files in there. Secondary question as to why font files are in there, particularly if it's a backend application, but we'll leave that aside. If you're wondering what this malware does if you were to install it, it does exactly what you would expect North Korean hackers to do if they had access to your computer, right? It first installs dependencies like Axio, so that it can then connect to a C2 server that the attacker owns and controls and allows them to not only connect to your computer, but potentially run commands on your behalf, making it particularly scary. The C2 server that they're connecting to actually uses a squatted domain that looks like alchemy.com. Once it initially establishes a connection to the C2 server, it actually installs more nefarious malware in the form of Python and will also install Python if you don't have it so that it can connect a final backdoor and do more nefarious activity. So, shout out to Paul McCarty for finding this and reporting it. There is a link in the description as always of where you can read more about this information. All right, onto our final news story of today. Moving along, it appears that hackers have stolen the account details of nearly 30 million SoundCloud users. If you have been paying attention to the news, you'll remember that on December 15th, it was confirmed that SoundCloud had a breach. Thanks to new data from our friend Troy Hunt and Have I Been Pwned, it appears that the number of affected accounts reaches nearly 30 million or 20% of SoundCloud users. These numbers were first reported by Bleeping Computer, but were confirmed themselves a little bit later on in an updated security notice from SoundCloud. The data that's stolen appears to be username, email addresses, locations, and other profile statistics. What wasn't included and wasn't stolen in this data was passwords. Which means that whilst the attackers may be able to harass some users and send them some scary phishing type emails or ransom type emails, no truly sensitive data appears to have been stolen at this point. Speaking of those attackers, this one has been attributed to Shiny Hunters. Now, also if you are listening to the news, you'll know that Shiny Hunters are very, very active at the moment. They are a ransomware group and recently it was confirmed that they managed to steal information, similar types of data, from a certain adult website that we won't name for the sake of all the algorithms, but the modus operandi appears to be the same: trying to break in and steal large vast amounts of information, hold up the company for ransom, if that fails then to result back in harassing those users and trying to ransom people individually. I'm quite certain that this isn't going to be the last time we hear of Shiny Hunters in 2026. Well, that's all we had for you today. If you like this video, please make sure you subscribe to the channel, like this video. Hey, even leave me a little cheeky comment if you feel so inclined. It really helps us get the show out there. We release two videos every single week. A thought leadership video on Tuesday, and a news style video like this one on Thursday. So, we hope to see you next week. And until then, stay secure.
