Researchers Uncover 108 Malicious Chrome Extensions

Security researchers have uncovered a coordinated campaign involving 108 malicious extensions in the Google Chrome Web Store, which have been installed approximately 20,000 times and are designed to steal user data, hijack accounts, and enable unauthorized browser access.

The extensions, published under five different developer identities, masquerade as legitimate tools including Telegram sidebar clients, slot machine and Keno games, YouTube and TikTok enhancers, text translation utilities, and general browser helpers. Despite appearing functional on the surface, they connect to the same command-and-control infrastructure, indicating operation by a single threat actor. Researchers from the firm Socket identified these patterns through analysis of the extensions' backend systems and code, which include Russian-language comments suggesting a possible malware-as-a-service model.

Among the most concerning behaviors, 54 extensions harvest Google account details such as email addresses, names, profile pictures, and unique account identifiers, along with OAuth2 bearer tokens, immediately after users sign in. These tokens allow access to user data without further authentication. Another...