Fake “Save to Google Drive” Extension

Cybercriminals continue to exploit popular tools and services to deceive users into installing malicious software. One such threat is the fake “Save to Google Drive” extension. Masquerading as the legitimate Google tool, this extension is actually a browser hijacker that compromises user security. It monitors browsing activity, collects sensitive information, and redirects users to malicious websites.

Overview of the Fake “Save to Google Drive” Extension

The table below summarizes the key details of the “Save to Google Drive” malware:

Attribute	Details
Name	“Save to Google Drive” Virus
Threat Type	Browser Hijacker, Redirect, PUP (Potentially Unwanted Program)
Associated Malware	Joas, Kotalq, Legion malware loader
Detection Names	Varies by antivirus software; detected as a browser hijacker or PUP
Symptoms of Infection	– Browser redirects to unknown pages – Unauthorized changes to search engine and homepage settings – Increased unwanted ads and pop-ups – Potential data theft and credential harvesting
Damage Caused	– Theft of personal information – Increased vulnerability to further malware infections – Unwanted advertisements and browser slowdowns – Unauthorized modifications to browser settings
Distribution Methods	– Malicious ads and pop-ups – Fake software updates and downloads – Bundled with freeware and pirated software
Danger Level	High

How the Fake "Save to Google Drive" Extension Works

The fraudulent "Save to Google Drive" extension operates under the guise of a useful tool, promising to help users quickly save web content to their Google Drive accounts. However, once installed, it takes control of the browser, injecting unwanted ads, tracking user activity, and redirecting users to potentially harmful sites.

Additionally, this extension has been linked to malware distribution campaigns, dropping threats like Joas and Kotalq, which can lead to further system compromise through the Legion malware loader.

How to Remove the Fake "Save to Google Drive" Extension

Step 1: Uninstall the Fake Extension from Your Browser

For Google Chrome

1. Open Google Chrome and click on the three-dot menu in the top-right corner.
2. Select Extensions from the More Tools submenu.
3. Look for the "Save to Google Drive" extension.
4. Click Remove and confirm the action.

For Mozilla Firefox

1. Open Firefox and click on the menu button (three horizontal lines).
2. Select Add-ons and Themes and go to the Extensions tab.
3. Find the suspicious extension and click Remove.

For Microsoft Edge

1. Open Edge and click on the three-dot menu.
2. Go to Extensions.
3. Locate the fake "Save to Google Drive" extension and click Remove.

Step 2: Scan Your System with SpyHunter

1. Download SpyHunter.
2. Install the software following the on-screen instructions.
3. Launch SpyHunter and click Start Scan.
4. Wait for the scan to complete and review the detected threats.
5. Click Fix Threats to remove malware from your system.

Step 3: Reset Browser Settings

If your browser is still experiencing issues after removal, reset it to default settings.

For Google Chrome

1. Open Chrome and go to Settings.
2. Scroll down and click Advanced.
3. Under Reset and Clean Up, click Restore settings to their original defaults.
4. Confirm by clicking Reset settings.

For Mozilla Firefox

1. Open Firefox and go to Help > Troubleshooting Information.
2. Click Refresh Firefox.
3. Confirm and restart the browser.

For Microsoft Edge

1. Open Edge and go to Settings > Reset Settings.
2. Click Restore settings to their default values.
3. Confirm the action.

Prevention Tips to Avoid Future Infections

To prevent browser hijackers like the fake "Save to Google Drive" extension from infecting your system, follow these best practices:

• Download Extensions Only from Trusted Sources: Always install browser extensions from official stores like the Chrome Web Store and check user reviews and developer details.
• Keep Your Software Updated: Regularly update your browser and operating system to patch security vulnerabilities.
• Use a Reliable Anti-Malware Program: Install security software such as SpyHunter to detect and remove threats before they cause harm.
• Be Wary of Free Software Bundles: Avoid downloading software from unverified sources, and always choose "Custom Installation" to prevent unwanted programs from being installed.
• Enable Safe Browsing Features: Most browsers offer built-in security features that help detect and block malicious websites and downloads.

Conclusion

The fake "Save to Google Drive" extension is a deceptive and dangerous browser hijacker that poses a serious risk to user privacy and security. It can monitor your online activities, steal sensitive data, and redirect you to malicious websites. If you suspect your system has been compromised, take immediate action by removing the extension, scanning for additional malware with SpyHunter, and restoring your browser settings.

By following the preventive measures outlined in this article, you can minimize the risk of falling victim to similar threats in the future. Stay vigilant and always verify the legitimacy of browser extensions before installing them.