The authors of a malicious Chrome extension recently retooled the threat to spread via Facebook Messenger and mine cryptocurrency.

The extension, FacexWorm, was removed from Google’s Chrome webstore last month and Facebook can now detect and block when malicious links are shared through Messenger via the extension.

Researchers with Trend Micro's TrendLabs, acknowledged Monday that a previous iteration of the extension was first discovered last fall but said that the firm noticed a spike in activity surrounding FacexWorm early last month. Specifically researchers claim there were reports of the platform spreading malicious links in Germany, Tunisia, Japan, Taiwan, South Korea, and Spain.

Victims who click through the malicious link, sent via Messenger, are redirected to a phony YouTube page that prompts them to download FacexWorm. The extension then opens Facebook, requests an OAuth token from the site, and essentially steals the victim's friends list, sending any user online or idle a message pushing the same fake YouTube video out.

While unnamed at the time, David Jacoby, a Senior Security Researcher with Kaspersky Lab's Global Research & Analysis Team, discovered the malware/adware last August. Similar to TrendMicro's findings, Jacoby observed the malware redirecting victims to a fake YouTube video while on Chrome.

What the latest version of FacexWorm is really after, like many strains of malware these days, is digital money, cryptocurrency. While the extension can ping its command and control server for JavaScript code to steal Google credentials, it's also interested in any logins the victim may have for MyMonero, a wallet that allows users to send and receive Monero, and Coinhive, a service that allows users to embed JavaScript miners for the Monero Blockchain.

Monero has been around since 2014 but it's only been in the last year or so that the untraceable open source cryptocurrency has caught on with cybercriminals.