Researchers Link 108 Malicious Chrome Extensions to Shared C2 and Data Theft

Apr 14, 2026 · Original article ↗

Summary

Socket researchers identified 108 Chrome extensions (~20,000 installs) sharing C2 infrastructure. They detail Google identity harvesting, Telegram session theft, remote URL execution and defenses; the extensions were live when reported.

Key points

Socket researchers linked 108 extensions across five publisher identities to shared C2 infrastructure at cloudapi[.]stream, with about 20,000 installs; the extensions were live when reported.
Fifty-four extensions sent users’ Google profile details to the operators after sign-in. The article says the OAuth token itself remained in the browser.
Telegram Multi-account exfiltrated Telegram Web session data every 15 seconds and could replace a victim’s local session with operator-supplied data.
Forty-five extensions included a startup backdoor that sent the extension ID to the C2 and could open a server-specified URL.
Researchers found five extensions removing security headers on targeted sites; other findings included server-controlled HTML injection and routing translation requests through operator infrastructure.
Socket submitted takedown requests and recommended removing affected extensions, terminating Telegram sessions, reviewing third-party Google access, and blocking campaign infrastructure.

Article Details

Attack Vectors: 108 malicious Chrome extensions shared campaign infrastructure and collected approximately 20,000 installs across five publisher identities.
54 extensions used chrome.identity.getAuthToken to retrieve Google profile data and send identity details to the campaign's server.
Telegram Multi-account extracted Telegram Web session data from localStorage and repeatedly sent it to the campaign server; the extension also supported replacing the active session with operator-supplied data.
45 extensions contacted a server endpoint at browser startup and could silently open a URL supplied in the response.
Some extensions removed security headers, spoofed request headers, injected content or advertisements, and routed translation requests and submitted text through campaign servers.
Defensive Notes: Remove the identified malicious extensions from Chrome.
For Telegram Multi-account users, terminate other Telegram sessions through the Telegram mobile app.
Users who signed in to affected extensions should review and revoke unfamiliar third-party app access; the article says Google identity details were exposed, but the OAuth token itself was not sent to the operator.
Block cloudapi[.]stream and its campaign subdomains, as well as top[.]rodeo.
Scan extension bundles for the startup pattern combining user_info, infoURL, and chrome.tabs.create, and review declarativeNetRequest rules that remove Content-Security-Policy from target sites.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`api[.]cloudapi[.]stream`	Campaign translation API that received user registration details and translation requests.
DOMAIN	`cdn[.]cloudapi[.]stream`	Campaign host used to serve game assets to its extensions.
DOMAIN	`chat[.]cloudapi[.]stream`	Listed as a service subdomain used by campaign extensions.
DOMAIN	`cloudapi[.]stream`	Shared campaign C2 domain used by the malicious extensions.
DOMAIN	`gamewss[.]cloudapi[.]stream`	Campaign WebSocket game server.
DOMAIN	`mines[.]cloudapi[.]stream`	Campaign server used to receive Google identity data and provide the extension startup backdoor response.
DOMAIN	`multiaccount[.]cloudapi[.]stream`	Campaign ad-injection host; the article identifies a game banner served from this subdomain.
DOMAIN	`tg[.]cloudapi[.]stream`	Campaign server used for Telegram session exfiltration and session-management endpoints.
DOMAIN	`top[.]rodeo`	Campaign game-server backend used by extensions; also listed as a developer URL.
DOMAIN	`topup[.]cloudapi[.]stream`	Campaign payment and monetization portal.
IPV4	`144[.]126[.]135[.]238`	Shared backend host for the campaign's malicious extensions.
URL	`hxxps[:]//api[.]cloudapi[.]stream:8443/Register`	Campaign translation service endpoint receiving user registration details.
URL	`hxxps[:]//api[.]cloudapi[.]stream:8443/Translation`	Campaign endpoint receiving text submitted by users of the translation extension.
URL	`hxxps[:]//mines[.]cloudapi[.]stream/auth_google`	Campaign endpoint receiving Google profile and identity data harvested by extensions.
URL	`hxxps[:]//mines[.]cloudapi[.]stream/user_info`	Campaign endpoint receiving extension identifiers and returning backdoor and injected-content data.
URL	`hxxps[:]//multiaccount[.]cloudapi[.]stream/game.html`	Campaign-hosted game banner identified as injected into extension and target-site content.
URL	`hxxps[:]//tg[.]cloudapi[.]stream/count_sessions.php`	Campaign endpoint polled by the extension to report the number of active Telegram sessions.
URL	`hxxps[:]//tg[.]cloudapi[.]stream/save_session.php`	Campaign endpoint receiving stolen Telegram Web session data.