{"id":24240,"date":"2026-05-07T10:00:36","date_gmt":"2026-05-07T03:00:36","guid":{"rendered":"https:\/\/fpt-is.com\/en\/?post_type=goc_nhin_so&p=24240"},"modified":"2026-06-23T14:11:45","modified_gmt":"2026-06-23T07:11:45","slug":"108-chrome-extensions-are-secretly-stealing-your-account","status":"publish","type":"goc_nhin_so","link":"https:\/\/fpt-is.com\/en\/insights\/108-chrome-extensions-are-secretly-stealing-your-account\/","title":{"rendered":"108 Chrome Extensions are secretly stealing your account – Are you on the list of victims?"},"content":{"rendered":"

Summary of the campaign<\/span><\/h2>\n

How did 108 independent Chrome extensions – from text translation apps to seemingly harmless minigames – bypass security censorship and silently manipulate over 20,000 browsers? In-depth analysis reveals that all these extensions are fronts, controlled by a single C2 server network operating under a Malware-as-a-Service (MaaS) model. This sophisticated campaign avoids damaging devices to evade detection; instead, it quietly acts like an undercover scout: permanently hijacking Google OAuth identities, periodically “gutting” Telegram Web login sessions every 15 seconds, and directly inserting a backdoor into the victim’s interface. The thought-provoking question for every organization is whether the translation tools or sidebars employees use daily are directly sending internal data to unknown servers. The urgent action now is to review extension installation logs and immediately block the controlling IP range to stop the chain of trust leaks.<\/span><\/p>\n

\"145178c9<\/span><\/p>\n

Detection and Scope of Impact<\/span><\/h2>\n

According to the initial analysis, exactly 108 extensions containing malware have been or are being distributed through the Chrome Web Store. Although carefully disguised and released under the names of five independent publishers, including Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt, all these extensions point to a single backend server system. The exploited extensions cover a wide range, targeting all consumer segments: Telegram chat tools in sidebar form, slot machine gambling software, modules for optimizing YouTube\/TikTok resolution, multilingual translation tools, and traditional web display extensions. These malicious programs fully mimic the advertised functionality to deceive users, while the criminal modules…<\/span><\/p>\n

The exploitation process<\/span><\/h2>\n

\"1d945823<\/span><\/p>\n

Initial Access (T1189 – Drive-by Compromise)<\/strong><\/span><\/p>\n

Attackers trick victims into installing seemingly legitimate extensions from the official Chrome Web Store to establish a foothold for internal attacks.<\/span><\/p>\n

Execution (T1059 – Command and Scripting Interpreter)<\/strong><\/span><\/p>\n

As soon as the browser starts, hidden scripts (e.g., loadInfo()) and background runtime are invoked to automatically execute data collection cycles using background installation permissions.<\/span><\/p>\n

Credential Access (T1539 – Steal Web Session Cookie \/ T1552 – Unsecured Credentials)<\/strong><\/span><\/p>\n

Google Account: The extension sends a webhook to call Google’s OAuth2 API to request permanent profile data (subject ID, email, name).<\/span><\/p>\n

Telegram Account: The malware actively queries the localStorage variable, periodically extracting the key containing the user_auth parameter of Telegram Web.<\/span><\/p>\n

\"43a28e6c<\/span><\/p>\n

Collection (T1114 – Email Collection\/Info Theft)<\/strong><\/span><\/p>\n

Text translation tools capture all the victim’s language query strings due to their ability to read the text input frame, attach them to the X-Key parameter, and steal them. Every draft and secret message that needs to be copied for translation is recorded.<\/span><\/p>\n

Command and Control (T1071.001 – Web Protocols)<\/strong><\/span><\/p>\n

All data is illicitly transferred via the TLS protocol directly to the subdomains of cloudapi[.]stream. The attacker maintains a strong C2 capable of sending custom HTML parameters, inserting a backdoor that forces the browser to load remote URL code without user intervention.<\/span><\/p>\n

\"Command<\/span><\/p>\n

\"Command<\/span><\/p>\n

Detailed Technical Analysis<\/span><\/h2>\n

Steal Telegram session periodically<\/span><\/h3>\n

In the group of extensions masquerading as Telegram integration tools (like Telegram Multi-account), the malware injects the target content.js file into the domain\u00a0https:\/\/web.telegram.org\/\\<\/a>*. The function getSessionDataJson() scans and exhausts the localStorage area, extracting the web session authentication string and directly transferring it via chrome.runtime.sendMessage().<\/span><\/p>\n

\"Steal<\/span><\/p>\n

The level of manipulation by the C2 reaches unpredictable heights with the webhook command set_session_changed. After intercepting the request, the server deletes the entire current localStorage and inserts a foreign token. This trick aims to force the victim out of their actual account and use the victim’s own browser to log in with a different malicious profile.<\/span><\/p>\n

Exploiting Google OAuth2 Identification<\/span><\/h3>\n

Instead of attempting phishing for passwords, which carries a high risk of being blocked, 54 extensions in this campaign target Google identity at the infrastructure level. They use the function chrome.identity.getAuthToken to request tokens from users. Once successful, the data sent back to the C2 server includes the permanent sub identifier, along with the email and real name. Collecting the sub index helps the criminals’ CRM cross-reference and ensures they never lose track of the user, even if the victim changes their email later.<\/span><\/p>\n

\"Exploiting<\/span><\/p>\n

All Client IDs (about 56 IDs) configured for this purpose belong to only 2 Google Cloud projects: 1096126762051 and 170835003632. This fact alone dispels the facade of separation by the five different publisher names.<\/span><\/p>\n

Universal Backdoor<\/strong>\u00a0loadInfo()<\/code><\/span><\/h3>\n

A critical security vulnerability within internal networks lies in the backdoor feature loadInfo(), spread across at least 45 original background configuration files. When Chrome is about to launch, the malware connects to the C2 address. If the response returns a JSON parameter infoURL, the C2 forces the extension to secretly create a tab and immediately redirect the URL. Source analysis shows loadInfo() often uses a concise async\/await technique in minified code format, indicating the insertion of external code rather than from a professional original code source.<\/span><\/p>\n

Configuration Security Header<\/span><\/h3>\n

Instead of attacking webRequest, five extensions have exploited the declarativeNetRequest API (a feature of Manifest V3, known for being more stringent) to strip protection:<\/span><\/p>\n