German Bundesamt für Verfassungsschutz (BfV) and the National Intelligence Service of the Republic of Korea (NIS) issue the following Joint Cyber Security Advisory to raise awareness of KIMSUKY’s (a.k.a. Thallium, Velvet Chollima, etc.) cyber campaigns against Google's browser and app store services targeting experts on the Korean Peninsula and North Korea issues.
(PDF download via)
The extension is named 'AF' and can only be seen in the extensions list if the user enters "(chrome|edge| brave)://extensions" in the browser's address bar.
Kimsuky (aka Thallium, Velvet Chollima) is a North Korean threat group that uses spear phishing to conduct cyber-espionage against diplomats, journalists, government agencies, university professors, and politicians
While the current campaign targets people in South Korea, the techniques used by Kimsuky can be applied globally, so raising awareness is vital.
North Korean hackers using Chrome extensions to steal Gmail emails
more here