TLDR Tech / InfoSec
108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure
Socket's Threat Research Team uncovered 108 malicious Chrome extensions, affecting approximately 20,000 installations, operating as a coordinated Malware-as-a-Service (MaaS) campaign. These extensions utilize a shared command and control (C2) infrastructure at cloudapi[.]stream. Fifty-four extensions harvest Google OAuth2 identity tokens, one actively exfiltrates Telegram Web sessions, and 45 include a universal backdoor to open operator-specified URLs. Investigations revealed all five publisher identities link to two Google Cloud project numbers, and the C2 backend uses a Strapi CMS with a payment portal, indicating the identities are sold as a service. Recommendations include blocking cloudapi[.]stream and top[.]rodeo, scanning extension bundles for specific patterns, and flagging extensions combining identity permissions with declarativeNetRequest rules that remove CSP headers.
Read the full story