108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users

Researchers discovered 108 malicious Chrome extensions stealing user data from 20,000 users through coordinated command-and-control infrastructure.

• •The extensions are distributed under five different publisher identities (Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt) on the Chrome Web Store.
• •54 extensions steal Google account identity via OAuth2, while 45 contain universal backdoors that open arbitrary URLs upon browser startup.
• •The malicious extensions exfiltrate Telegram Web sessions every 15 seconds, strip security headers from YouTube and TikTok to inject gambling overlays, and inject content scripts into every visited page.
• •All 108 extensions share the same backend infrastructure hosted at 144.126.135.238, with Russian language comments found in the source code suggesting possible attribution.