LayerX Reports TikTok Downloader Extensions Harvesting Data from 130,000 Users
Summary
LayerX researchers report that at least 12 TikTok downloader extensions affected over 130,000 Chrome and Edge users, collecting telemetry and using remote configuration to change behavior after installation.
Key points
- LayerX researchers identified at least 12 related extensions posing as TikTok downloaders across Chrome and Edge marketplaces.
- The researchers say the campaign affected over 130,000 users.
- The extensions reuse a code family and include clones or lightly rebranded versions.
- Some extensions reportedly operated legitimately for 6–12 months and earned “Featured” badges before introducing malicious behavior.
- Remote configuration lets the extensions change behavior after installation.
- Collected telemetry reportedly includes usage patterns, interacted content, device language, timezone, user agent, and battery status, which can support user fingerprinting.
- LayerX warns that the extensions could potentially enable broader data exfiltration or abuse of authenticated requests.
Article Details
- Event Type
- Coordinated campaign of malicious browser extensions posing as TikTok downloaders
- Impact
- LayerX reported that at least 12 interconnected extensions compromised more than 130,000 users across Google Chrome and Microsoft Edge. The extensions collected usage and device telemetry, including language, timezone, user agent, and battery status, enabling user fingerprinting. LayerX warned of potential future data exfiltration, abuse of authenticated requests, or integration into proxy or botnet-like infrastructure.
Vendors
GoogleThe operation has compromised over 130,000 users on Google Chrome and Microsoft Edge by reusing a single code family, employing long-lived trust-building tactics, and using remote configuration to change maliciousMicrosoftThe operation has compromised over 130,000 users on Google Chrome and Microsoft Edge by reusing a single code family, employing long-lived trust-building tactics, and using remote configuration to change malicious
Products
Google ChromeThe operation has compromised over 130,000 users on Google Chrome and Microsoft Edge by reusing a single code family, employing long-lived trust-building tactics, and using remote configuration to change maliciousMicrosoft EdgeThe operation has compromised over 130,000 users on Google Chrome and Microsoft Edge by reusing a single code family, employing long-lived trust-building tactics, and using remote configuration to change maliciousTikTokLayerX researchers uncovered a coordinated campaign of at least 12 browser extensions that pose as TikTok downloaders while secretly tracking users and harvesting telemetry.