Socket Finds 108 Malicious Chrome Extensions, More Than 20,000 Installs
Summary
Socket identified 108 malicious Chrome extensions with more than 20,000 installs, linked by shared command-and-control infrastructure. They reportedly steal Google and Telegram data, inject ads, or open attacker-selected URLs; Google had not immediately removed them.
Key points
- Socket identified 108 extensions published through five accounts: GameGen, InterAlt, SideGames, Rodeo Games, and Yana Project; they reportedly share backend infrastructure.
- Fifty-four extensions reportedly steal Google account information by obtaining an OAuth2 bearer token locally and sending the user's email, name, and profile picture to a remote server.
- Forty-five extensions reportedly contain a backdoor that opens a URL supplied by command-and-control infrastructure when the browser starts.
- Some Telegram extensions reportedly steal active web sessions; one described method overwrites local storage with attacker-supplied data and reloads Telegram.
- Other extensions reportedly exfiltrate Telegram sessions, inject ads or content scripts, or proxy translation requests through an attacker-controlled server.
- Socket said it reported the extensions, but they were not immediately removed from the Chrome Web Store.
Article Details
- Event Type
- Coordinated campaign involving malicious Chrome extensions
- Impact
- Socket reports that 108 extensions had malicious capabilities and were installed by over 20,000 users. The reported activities include stealing Google account information and Telegram sessions, opening attacker-selected URLs through a backdoor, injecting ads or content, and proxying translation requests through an attacker-controlled server.
Vendors
Products
Chrome Web Storeallows the operators to activate a payload directly, without updating the application through the Chrome Web Store.Google ChromeOver 20,000 users installed malicious Chrome extensions designed to provide a backdoor, steal information, or inject ads, cybersecurity firm Socket reports.Telegram WebSocket draws attention to the Telegram Multi-account extension, which steals the active Telegram Web session and allows the attackers to take over the user account by overwriting the local storage with attacker-suppliedTikTokThe remaining extensions were designed to exfiltrate Telegram sessions, inject ads into YouTube and TikTok pages, inject content scripts into all visited pages, or to proxy translation requests through anYouTubeThe remaining extensions were designed to exfiltrate Telegram sessions, inject ads into YouTube and TikTok pages, inject content scripts into all visited pages, or to proxy translation requests through an