More than 100 malicious extensions in the official Chrome Web Store are attempting to steal Google OAuth2 Bearer tokens, deploy backdoors, and carry out ad fraud.
Researchers at application security company Socket discovered that the malicious extensions are part of a coordinated campaign that uses the same command-and-control (C2) infrastructure.
The threat actor published the extensions under five distinct publisher identities in multiple categories: Telegram sidebar clients, slot machine and Keno games, YouTube and TikTok enhancers, a text translation tool, and utilities.
According to the researchers, the campaign uses a central backend hosted on a Contabo VPS, with multiple subdomains handling session hijacking, identity collection, command execution, and monetization operations.
Socket has found evidence indicating a Russian malware-as-a-service (MaaS) operation, based on comments in the code for authentication and session theft.
Source: Socket
Harvesting data and hijacking accounts
The largest cluster, comprising 78 extensions, injects attacker-controlled HTML into the user interface via the ‘innerHTML’ property.
The second-largest group, with 54 extensions, uses ‘chrome.identity.getAuthToken’ to collect the victim’s email, name, profile picture, and Google account ID.
They also steal the Google OAuth2 Bearer token, a short-lived access token that permits applications to access a user’s data or to act on their behalf.
Source: Socket
A third batch of 45 extensions features a hidden function that runs on browser startup, acting as a backdoor that fetches commands from the C2 and can open arbitrary URLs. This function does not require the user to interact with the extension.
One extension highlighted by Socket as “the most severe” steals Telegram Web sessions every 15 seconds, extracts session data from ‘localStorage’ and the session token for Telegram Web, and sends the info to the C2.
“The extension also handles an inbound message (set_session_changed) that performs the reverse operation: it clears the victim’s localStorage, overwrites it with threat actor-supplied session data, and force-reloads Telegram,” describes Socket.
“This allows the operator to swap any victim’s browser into a different Telegram account without the victim’s knowledge.”
The researchers also found three extensions that strip security headers and inject ads into YouTube and TikTok, one that proxies translation requests through a malicious server, and a non-active Telegram session theft extension that uses staged infrastructure.
Socket has notified Google about the campaign, but warns that all malicious extensions are still available on the Chrome Web Store at the time of publishing their report.
BleepingComputer confirms that many of the extensions listed in Socket’s report are still available at publishing time. We have reached out to Google for a comment on this, but we have not heard back.
Users are recommended to search their installed extensions against the IDs Socket published, and uninstall any matches immediately.
Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.
This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.
