Cybersecurity researchers have uncovered a large-scale malicious campaign involving 108 Google Chrome extensions designed to steal user data and manipulate browser activity.
The campaign reveals a critical risk:
Even trusted browser extensions can silently compromise your identity, sessions, and browsing activity.
What was discovered?
A cluster of 108 Chrome extensions was found to be:
- Connected to the same command-and-control (C2) infrastructure
- Published under multiple fake developer identities
- Installed over 20,000 times via the Chrome Web Store
Fake publishers include:
- Yana Project
- GameGen
- SideGames
- Rodeo Games
- InterAlt
What these extensions do
These extensions go far beyond simple data collection.
Researchers identified multiple malicious capabilities:
Credential & identity theft
- Steal Google account data via OAuth2
- Capture:
- Full name
- Profile picture
- Account ID
Session hijacking
- Exfiltrate Telegram Web sessions every 15 seconds
- Replace user sessions with attacker-controlled sessions
Browser manipulation
- Inject scripts into every visited website
- Open arbitrary URLs on browser startup
- Strip security protections from websites
Ad injection & abuse
- Inject ads and gambling overlays
- Modify YouTube and TikTok behavior
- Proxy translation traffic through attacker servers
How the attack works
The extensions disguise themselves as legitimate tools, such as:
- Telegram clients
- Browser utilities
- Translation tools
- Games (e.g., racing, slot machines)
- YouTube/TikTok enhancers
👉 Once installed, malicious code runs silently in the background, giving attackers full control over browser activity.
Shared infrastructure
All 108 extensions communicate with the same backend server:
👉 144.126.135[.]238
This centralized infrastructure enables:
- Data exfiltration
- Command execution
- Coordinated control across all infected browsers
Attribution clues
While the exact threat actor remains unknown:
- Source code contains Russian-language comments
- Suggesting possible regional links
Why this is dangerous
This campaign highlights a major security blind spot:
Browser extensions operate with high privileges — often with minimal user scrutiny.
Once installed, they can:
- Access all browsing data
- Modify web content
- Interact with authentication sessions
👉 Effectively acting as persistent spyware inside the browser
What users should do immediately
1. Remove suspicious extensions
Especially unknown or rarely used ones
2. Log out of active sessions
Particularly:
- Telegram Web
- Google accounts
3. Review installed extensions
Check permissions and publisher credibility
4. Use minimal extensions
Only install what is absolutely necessary
5. Enable security monitoring
Use endpoint/browser protection where possible
Key takeaway
This campaign reinforces a critical lesson:
Your browser is part of your attack surface — and extensions are often the weakest link.
Even official marketplaces like the Chrome Web Store
can be abused to distribute stealthy, large-scale threats.
