Over 100 Chrome Web Store extensions steal user accounts, data

Summary

Security researchers at Socket discovered a coordinated campaign of 100+ malicious extensions in the official Chrome Web Store designed to steal Google OAuth2 Bearer tokens, harvest account data, deploy backdoors, and commit ad fraud. The extensions are published under five distinct identities across multiple categories (games, productivity, video enhancers) and use shared C2 infrastructure hosted on Contabo VPS. Google was notified but the extensions remained available on the store at the time of publication.

Full text

Over 100 Chrome Web Store extensions steal user accounts, data By Bill Toulas April 14, 2026 04:33 PM 0 More than 100 malicious extensions in the official Chrome Web Store are attempting to steal Google OAuth2 Bearer tokens, deploy backdoors, and carry out ad fraud. Researchers at application security company Socket discovered that the malicious extensions are part of a coordinated campaign that uses the same command-and-control (C2) infrastructure. The threat actor published the extensions under five distinct publisher identities in multiple categories: Telegram sidebar clients, slot machine and Keno games, YouTube and TikTok enhancers, a text translation tool, and utilities. According to the researchers, the campaign uses a central backend hosted on a Contabo VPS, with multiple subdomains handling session hijacking, identity collection, command execution, and monetization operations. Socket has found evidence indicating a Russian malware-as-a-service (MaaS) operation, based on comments in the code for authentication and session theft. Extensions linked to the same campaignSource: Socket Harvesting data and hijacking accounts The largest cluster, comprising 78 extensions, injects attacker-controlled HTML into the user interface via the ‘innerHTML’ property. The second-largest group, with 54 extensions, uses ‘chrome.identity.getAuthToken’ to collect the victim’s email, name, profile picture, and Google account ID. They also steal the Google OAuth2 Bearer token, a short-lived access token that permits applications to access a user's data or to act on their behalf. Google account data harvestingSource: Socket A third batch of 45 extensions features a hidden function that runs on browser startup, acting as a backdoor that fetches commands from the C2 and can open arbitrary URLs. This function does not require the user to interact with the extension. One extension highlighted by Socket as “the most severe” steals Telegram Web sessions every 15 seconds, extracts session data from ‘localStorage’ and the session token for Telegram Web, and sends the info to the C2. “The extension also handles an inbound message (set_session_changed) that performs the reverse operation: it clears the victim's localStorage, overwrites it with threat actor-supplied session data, and force-reloads Telegram,” describes Socket. “This allows the operator to swap any victim's browser into a different Telegram account without the victim's knowledge.” The researchers also found three extensions that strip security headers and inject ads into YouTube and TikTok, one that proxies translation requests through a malicious server, and a non-active Telegram session theft extension that uses staged infrastructure. Socket has notified Google about the campaign, but warns that all malicious extensions are still available on the Chrome Web Store at the time of publishing their report. BleepingComputer confirms that many of the extensions listed in Socket’s report are still available at publishing time. We have reached out to Google for a comment on this, but we have not heard back. Users are recommended to search their installed extensions against the IDs Socket published, and uninstall any matches immediately. Automated Pentesting Covers Only 1 of 6 Surfaces. Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation. Get Your Copy Now Related Articles: QuickLens Chrome extension steals crypto, shows ClickFix attackMcGraw-Hill confirms data breach following extortion threatSnowflake customers hit in data theft attacks after SaaS integrator breachHackers use pixel-large SVG trick to hide credit card stealerGoogle Chrome adds infostealer protection against session cookie theft

Indicators of Compromise

• malware — Chrome Web Store Malicious Extension Campaign
• mitre_attack — T1528: Steal Application Access Token
• mitre_attack — T1539: Steal Web Session Cookie
• mitre_attack — T1197: BITS Jobs

Entities