108 Malicious Chrome Extensions Steal User Data via Shared Infrastructure

Key Takeaways

• A coordinated cyber espionage campaign is actively employing 108 malicious Google Chrome extensions.
• These extensions are designed to steal sensitive user data, including login credentials and active session tokens, effectively bypassing multi-factor authentication.
• The threat actors leverage a sophisticated, shared Command and Control (C2) infrastructure to manage and scale their data theft operations.
• The campaign poses a significant risk to both individual users and enterprise environments, potentially leading to widespread account compromise and network breaches.
• Mitigation requires auditing installed extensions, enforcing strict browser policies, and monitoring network traffic for suspicious activity.

A sophisticated cyber espionage operation is currently underway, utilizing a network of 108 malicious Google Chrome extensions to compromise user data and hijack active web sessions. Research by Socket reveals that these extensions are part of a highly organized campaign, operating through a unified Command and Control (C2) infrastructure designed for efficient data exfiltration.

This centralized backend allows the attackers to significantly expand their malicious activities without the overhead of developing distinct infrastructures for each rogue extension. This efficiency enables them to target a vast number of potential victims simultaneously.

Rogue Extensions Funnel User Data

The malicious extensions often masquerade as legitimate productivity tools, utility applications, or browser enhancements, tricking users into installing them. Once active, their true intent is revealed through hidden background scripts that silently monitor web browsing activities and harvest critical personal and corporate information.

Due to the shared C2 network, all 108 extensions direct their stolen data back to the same set of malicious servers. This shared architecture not only facilitates the efficient collection of stolen data but also allows the attackers to rapidly update their payloads, issue new commands, and process large volumes of information concurrently.

The primary objective of this coordinated campaign is the exfiltration of data and the theft of active user sessions. The extensions are specifically programmed to surreptitiously copy browser cookies, active session tokens, and saved login credentials. The theft of session tokens is particularly dangerous as it enables attackers to completely bypass multi-factor authentication (MFA).

With a valid session token, an attacker can gain direct access to secure accounts, including corporate email systems, financial dashboards, and internal company portals, without needing the user’s actual password. This capability represents a critical threat to enterprise environments, where the compromise of a single browser could lead to a severe network breach.

To evade detection, the perpetrators behind these extensions employ various stealth techniques. The malicious code is frequently heavily obfuscated to obscure its true purpose from automated security scanners. Many extensions also delay the execution of their data-stealing functions, a tactic designed to bypass initial security checks during the installation process.

Furthermore, the shared C2 infrastructure regularly changes its domain names and IP addresses, complicating efforts by security teams to permanently block malicious network traffic.

What You Should Do

• Audit Chrome Extensions: Organizations should immediately audit all Chrome extensions installed on corporate devices.
• Enforce Strict Policies: Implement and enforce strict enterprise policies that only permit pre-approved and thoroughly vetted extensions.
• Regularly Review Add-ons: Individual users must routinely review their browser add-ons and promptly remove any suspicious or unused extensions.
• Monitor Network Traffic: Network administrators should actively monitor outbound network traffic for connections to unrecognized servers.
• Deploy Endpoint Protection: Utilize endpoint protection solutions capable of detecting abnormal data exfiltration attempts from web browsers.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.