Researchers Find 100+ Malicious Chrome Extensions Targeting Google and Telegram Accounts
Summary
Socket researchers found 100+ Chrome Web Store extensions across five publisher identities, with behaviors including Google OAuth token theft, account-data harvesting, backdoors and Telegram session hijacking. They suspect a Russian MaaS operation and notified Google.
Key points
- Socket reported more than 100 malicious extensions published under five identities across several Chrome Web Store categories.
- One group of 54 extensions uses chrome.identity.getAuthToken to collect Google account details and OAuth2 bearer tokens.
- A group of 45 extensions can run on browser startup, fetch commands from a command-and-control server and open URLs.
- One highlighted extension reportedly steals Telegram Web session data every 15 seconds and can replace a victim’s session with attacker-supplied data.
- Other reported behaviors include injecting ads, stripping security headers and proxying translation requests through a malicious server.
- Socket notified Google; the article says many listed extensions remained available at publication, and recommends checking and removing matching extension IDs.
Article Details
- Event Type
- Coordinated campaign involving more than 100 malicious Chrome extensions
- Impact
- The extensions steal Google OAuth2 bearer tokens and Google account data; some also steal or replace Telegram Web sessions, fetch remote commands, open arbitrary URLs, inject ads, or proxy translation requests through a malicious server. Socket reported that the extensions remained available in the Chrome Web Store when its report was published.
MITRE ATT&CK
T1176 · Software ExtensionsMalicious Chrome extensions are used to steal data, deploy backdoors, and conduct ad fraud.T1528 · Steal Application Access TokenThe extensions steal Google OAuth2 bearer tokens that permit access to user data or actions on users’ behalf.T1539 · Steal Web Session CookieOne extension steals Telegram Web session data and a session token from localStorage.
Vendors
ContaboResearchers traced the command-and-control infrastructure to a Contabo VPS and linked the operation to a suspected Russian MaaS; users should check and remove any matching extension IDs.GoogleMore than 100 malicious Chrome extensions form a coordinated campaign that steals Google OAuth2 bearer tokens, harvests account data, deploys backdoors, and conducts ad fraud.TelegramSome extensions include startup backdoors that fetch remote commands and one actively steals and swaps Telegram Web sessions.
Products
Chrome Web StoreMore than 100 malicious extensions in the official Chrome Web Store are attempting to steal Google OAuth2 Bearer tokens, deploy backdoors, and carry out ad fraud.Google ChromeMore than 100 malicious Chrome extensions form a coordinated campaign that steals Google OAuth2 bearer tokens, harvests account data, deploys backdoors, and conducts ad fraud.Telegram WebSome extensions include startup backdoors that fetch remote commands and one actively steals and swaps Telegram Web sessions.