108 Chrome Extensions are secretly stealing your account – Are you on the list of victims?
Summary of the campaign
How did 108 independent Chrome extensions—from text translation apps to seemingly harmless minigames—bypass security censorship and silently manipulate over 20,000 browsers? In-depth analysis reveals that all these extensions are fronts, controlled by a single C2 server network operating under a Malware-as-a-Service (MaaS) model. This sophisticated campaign avoids damaging devices to evade detection; instead, it quietly acts like an undercover scout: permanently hijacking Google OAuth identities, periodically "gutting" Telegram Web login sessions every 15 seconds, and directly inserting a backdoor into the victim's interface. The thought-provoking question for every organization is whether the translation tools or sidebars employees use daily are directly sending internal data to unknown servers. The urgent action now is to review extension installation logs and immediately block the controlling IP range to stop the chain of trust leaks.
Detection and Scope of Impact
According to the initial analysis, exactly 108 extensions containing malware have been or are being distributed through the Chrome Web Store. Although carefully disguised and released under the names of five independent publishers, including Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt, all these extensions point to a single backend server system. The exploited extensions cover a wide range, targeting all consumer segments: Telegram chat tools in sidebar form, slot machine gambling software, modules for optimizing YouTube/TikTok resolution, multilingual translation tools, and traditional web display extensions. These malicious programs fully mimic the advertised functionality to deceive users, while the criminal modules...
The exploitation process
Initial Access (T1189 - Drive-by Compromise)
Attackers trick victims into installing seemingly legitimate extensions from the official Chrome Web Store to establish a foothold for internal attacks.
Execution (T1059 - Command and Scripting Interpreter)
As soon as the browser starts, hidden scripts (e.g., loadInfo()) and background runtime are invoked to automatically execute data collection cycles using background installation permissions.
Credential Access (T1539 - Steal Web Session Cookie / T1552 - Unsecured Credentials)
Google Account: The extension sends a webhook to call Google's OAuth2 API to request permanent profile data (subject ID, email, name).
Telegram Account: The malware actively queries the localStorage variable, periodically extracting the key containing the user_auth parameter of Telegram Web.
Collection (T1114 - Email Collection/Info Theft)
Text translation tools capture all the victim's language query strings due to their ability to read the text input frame, attach them to the X-Key parameter, and steal them. Every draft and secret message that needs to be copied for translation is recorded.
Command and Control (T1071.001 - Web Protocols)
All data is illicitly transferred via the TLS protocol directly to the subdomains of cloudapi[.]stream. The attacker maintains a strong C2 capable of sending custom HTML parameters, inserting a backdoor that forces the browser to load remote URL code without user intervention.
Detailed Technical Analysis
Steal Telegram session periodically
In the group of extensions masquerading as Telegram integration tools (like Telegram Multi-account), the malware injects the target content.js file into the domain https://web.telegram.org/\*. The function getSessionDataJson() scans and exhausts the localStorage area, extracting the web session authentication string and directly transferring it via chrome.runtime.sendMessage().
The level of manipulation by the C2 reaches unpredictable heights with the webhook command set_session_changed. After intercepting the request, the server deletes the entire current localStorage and inserts a foreign token. This trick aims to force the victim out of their actual account and use the victim's own browser to log in with a different malicious profile.
Exploiting Google OAuth2 Identification
Instead of attempting phishing for passwords, which carries a high risk of being blocked, 54 extensions in this campaign target Google identity at the infrastructure level. They use the function chrome.identity.getAuthToken to request tokens from users. Once successful, the data sent back to the C2 server includes the permanent sub identifier, along with the email and real name. Collecting the sub index helps the criminals' CRM cross-reference and ensures they never lose track of the user, even if the victim changes their email later.
All Client IDs (about 56 IDs) configured for this purpose belong to only 2 Google Cloud projects: 1096126762051 and 170835003632. This fact alone dispels the facade of separation by the five different publisher names.
Universal Backdoor loadInfo()
A critical security vulnerability within internal networks lies in the backdoor feature loadInfo(), spread across at least 45 original background configuration files. When Chrome is about to launch, the malware connects to the C2 address. If the response returns a JSON parameter infoURL, the C2 forces the extension to secretly create a tab and immediately redirect the URL. Source analysis shows loadInfo() often uses a concise async/await technique in minified code format, indicating the insertion of external code rather than from a professional original code source.
Xé Rào Configuration Security Header
Instead of attacking webRequest, five extensions have exploited the declarativeNetRequest API (a feature of Manifest V3, known for being more stringent) to strip protection:
Remove the Content-Security-Policy and X-Frame-Options directives from the target website (TikTok, YouTube).
Force the Access-Control-Allow-Origin: * parameter.
Spoof the User-Agent.
When all barriers have collapsed, the malware uses unsafe DOM-injection with the innerHTML variable. This results in automatically injecting junk HTML code and slot machine ads directly into the user interfaces of YouTube and TikTok.
Command and Control (C2) server infrastructure
The backend sketch of the 108 malware network fully reveals the C2 infrastructure located at Contabo GmbH VPS, IP 144.126.135.238. The server architecture uses Strapi CMS with a PostgreSQL data core, organized by subdomain, following a standard Malware-as-a-Service ecosystem.
tg[.]cloudapi[.]stream: Module exfiltration (Endpoint trace with /save_session.php).
mines[.]cloudapi[.]stream: Endpoint for Google identification, providing payload /user_info for tab-open backdoor.
topup[.]cloudapi[.]stream: Station issuing paid portal.
The main impact of the campaign
Instead of conducting ransomware encryption or system destruction, this campaign of distributing 108 extensions focuses on gathering intelligence and exploiting long-term trust. The direct impact chain includes:
Silent corporate data leaks (DLP Bypass): Translation and text processing tools are covertly sending all content handled by employees to the C2. This poses a risk of exposing source code, confidential contracts, and business secrets, which DLP solutions find difficult to detect due to packets being encrypted through Chrome's standard TLS layer.
Widespread Account Takeover (ATO): By stealing OAuth tokens directly and extracting localStorage data from Telegram Web, the attacker maintains a backdoor to access internal resources, completely bypassing two-factor authentication (2FA/MFA). This allows them to turn real identity accounts into bait for future internal phishing campaigns.
Exploitation and attack on the local supply chain: With the backdoor loadInfo(), the browsers of tens of thousands of personnel can be commanded by the C2 to open tabs running scripts to DDoS other targets, download OS-level malicious payloads, or simply manipulate displayed content (DOM-injection) to insert financial ads and scams directly onto their work screens.
Serious compliance violations: The overall picture reveals significant weaknesses in the organization's endpoint management (BYOD or lack of Allowlist Extension policy). It threatens strict security standards like ISO 27001 or PCI DSS when devices carry uncontrolled risks.
Expert opinion
The evolution of software in official stores often creates a false sense of security, yet risks are growing in the era of Manifest V3. Many cybersecurity engineers assume that updating Chrome's Manifest V3 will "patch" malware by eliminating the ability to block/modify webRequest packets. On the contrary, this campaign of 108 extensions clearly demonstrates how hackers have perfectly adapted by exploiting the available API—declarativeNetRequest. They blur the line between content moderation and violating Content-Security-Policy.
In the bigger picture, this is not an isolated act of individual theft but a smooth criminal business process (MaaS). The backend system manages cross-identity (Google Subject ID), builds Telegram Session warehouses, and maintains a separate payment module, illustrating the remarkably organized scale of this hacker group. The critical point for organizations lies in seemingly benign plugins like "Translation tool." When employees copy and translate regular text (sensitive contracts, code, architectural configurations), they rely on this intermediary channel to silently push data to the hidden /Translation request of the C2. A current Data Loss Prevention (DLP) solution struggles to detect these silent leaks passing through the SSL/HTTPS layer, often mistakenly perceived as a natural application feature.
Recommendation
Immediate (0-24h)
Review the DNS filter system, EDR, and web proxy firewall, and ensure the addition of rules to completely deny and block inbound/outbound traffic with domains *.cloudapi[.]stream, top[.]rodeo, and IP 144.126.135.238.
Initiate a centralized scan from Endpoint Manager or Active Directory on all devices. Force uninstall if a match is found with the extension ID strings in the whitelist. Simultaneously, force logout (revoke credentials) for any suspicious sessions working with Google.
Short-term (1-7 days)
Develop SIEM Correlation Rules to hunt for unusual actors, especially user-agent groups with a strong connection history to web.telegram.org or https://www.googleapis.com/oauth2/v3/userinfo not originating from the main Desktop/Web App.
Establish a process to clear caches and local tokens for suspicious users.
Long-term
- Switch entirely from a passive "Blocklist" model to an active "Allowlist" for all extensions operating on devices. The company should approve only plugins from publishers with a trust tier and a publicly available patch repository. Block any interference from extensions to internal domains.
MITRE ATT&CK
T1176 - Browser Extensions
T1539 - Steal Web Session Cookie
T1528 - Steal Application Access Token
T1041 - Exfiltration Over C2 Channel
T1071.001 - Application Layer Protocol: Web Protocols
T1027 - Obfuscated Files or Information
T1185 - Browser Session Hijacking
Indicators of Compromise (IOCs)
Email address
kiev3381917@gmail[.]comformatron.service@gmail[.]comnashprom.info@gmail[.]comviktornadiezhdin@gmail[.]comsupport@top[.]rodeoslava.nadejdin.kiev@gmail[.]comnadejdinv@gmail[.]com
Publisher name
Yana ProjectGameGenSideGamesRodeo GamesInterAlt
Project Credentials
Google Cloud Project:
1096126762051Google Cloud Project:
170835003632
Network Indicators
cloudapi[.]streamtg[.]cloudapi[.]streammines[.]cloudapi[.]streamtopup[.]cloudapi[.]streamcdn[.]cloudapi[.]streammultiaccount[.]cloudapi[.]streamwheel[.]cloudapi[.]streamgamewss[.]cloudapi[.]streamapi[.]cloudapi[.]streamchat[.]cloudapi[.]streamcrm[.]cloudapi[.]streamtop[.]rodeometal[.]cloudapi[.]stream144[.]126[.]135[.]238coin-miner[.]cloudapi[.]streamgoldminer[.]cloudapi[.]streamherculessportslegend[.]cloudapi[.]stream
C2 Endpoints
tg[.]cloudapi[.]stream/save_session.phptg[.]cloudapi[.]stream/count_sessions.phptg[.]cloudapi[.]stream/get_sessions.phptg[.]cloudapi[.]stream/get_session.phptg[.]cloudapi[.]stream/delete_session.phptg[.]cloudapi[.]stream/save_title.phpmines[.]cloudapi[.]stream/auth_googlemines[.]cloudapi[.]stream/user_infomines[.]cloudapi[.]stream/slot_test/api[.]cloudapi[.]stream:8443/Registerapi[.]cloudapi[.]stream:8443/Translationtop[.]rodeo/server/remote.phptop[.]rodeo/server/remote3.phptop[.]rodeo/notify.phpcloudapi[.]stream/install/cloudapi[.]stream/uninstall/
Chrome Extension IDs
obifanppcpchlehkjipahhphbcbjekfa- Telegram Multi-accountmdcfennpfgkngnibjbpnpaafcjnhcjno- Web Client for Telegram - Telesidemmecpiobcdbjkaijljohghhpfgngpjmk- YouSide - Youtube Sidebarbfoofgelpmalhcmedaaeogahlmbkopfd- Web Client for Youtube - SideYoucbfhnceafaenchbefokkngcbnejached- Web Client for TikTokogogpebnagniggbnkbpjioobomdbmdcj- Text Translationldmnhdllijbchflpbmnlgndfnlgmkgif- Page Lockerlnajjhohknhgemncbaomjjjpmpdigedg- Page Auto Refreshaecccajigpipkpioaidignbgbeekglkd- Web Client for Rugby Rush - SideGameakebbllmckjphjiojeioooidhnddnplj- Formula Rush Racing Gameakifdnfipbeoonhoeabdicnlcdhghmpn- Piggy Prizes - Slot Machineakkkopcadaalekbdgpdikhdablkgjagd- Slot Arabianalkfljfjkpiccfgbeocbbjjladigcleg- Frogtasticalllblhkgghelnejlggmmgjbkdabidie- Black Beard Slot Machineamkkjdjjgiiamenbopfpdmjcleecjjgg- Indian - Slot Machineamnaljnjmgajgajelnplfmidgjgbjfhe- Mahjong Deluxebbjdlbemjklojnbifkgameepcafflmem- Crazy Freekickbdnanfggeppmkfhkgmpojkhanoplkacc- Slot Car Racingbgdkbjcdecedfoejdfgeafdodjgfohno- Clear Cache Plusbnchgibgpgmlickioneccggfobljmhjc- Galactica Delux - Slot Machinebpljfbcejldmgeoodnogeefaihjdgbam- Speed Test for Chrome - WiFi SpeedTestcbnekafldflkmngbgmbnfmchjaelnhem- Game SkySpeedstercdpiopekjeonfjeocbfebemgocjciepp- Master Chesscehdkmmfadpplgchnbjgdngdcjmhlfcc- Hockey Shootoutcljengcehefhflhoahaambmkknjekjib- Odds Of The Gods - Slot Machineclpgopiimdjcilllcjncdkoeikkkcfbi- Billiards Procmeoegkmpbpcoabhlklbamfeidebgmdf- Three Card Pokercmlbghnlnbjkdgfjlegkbjmadpbmlgjb- Donuts - Slot Machinecnibdhllkgidlgmaoanhkemjeklneolk- Archer - Slot Machinecpnfioldnmhaihohppoaebillnambcgn- Rugby Rushdbohcpohlgnhgjmfkakoniiplglpfhcb- Bingodcamdpfclondppklabgkfaofjccpioil- Web Client for game Cricket Batter Challengedljlpildgknddpnahppkihgodokfjbnd- Slot Machine Zeus Treasuresdlpiookhionidajbiopmaajeckifeehn- Horse Racingdmaibhbbpmdihedidicfeigilkbobcog- Aztec - Slot Machinedohenclhhdfljpjlnpjnephpccbdgmmb- Straight 4dpdemambcedffmnkfmkephnhhnclmcio- Slot The Gold Potejlcbfmhjbkgohopdkijfgggbikgbacb- American Roulette Royaleeljfpgehlncincemdmmnebmnlcmfamhm- Asia Slotenmmilgindjmffoljaojkcgloakmloen- Web Client for game Drive Your Careoklnfefipnjfeknpmigmogeeepddcch- Jurassic Giants - Slot Machinefddajeklkkggbnppabbhkdmnkdjindlo- Street Basketballfibgndhgobbaaekmnneapojgkcehaeac- Tarot Side Panelfjfhejmbhpabkacpoddjbcfandjoacmb- Dragon Slayer - Slot Machineflkdjodmoefccepdihipjdlianmkmhgc- Best Blackjackfmajpchoiahphjiligpmghnhmabolhoh- Book Of Magic - Slot Machinegaafhblhbnkekenogcjniofhbicchlke- Snake - Slot Machinegbaoddbbpompjhmilbgiaapkkakldlpc- Dice King - Classic Craps And Roll Gamegbhhgipmedccnankkjchgcidiigmioio- Slot Ramsesgfhcdakcnpahfdealajmhcapnhhablbp- Battleship Wargipmochingljoikdjakkdolfcbphmlom- Gold Miner 2glofhphmolanicdaddgkmhfmjidjkaem- Greyhound Racing - Dog Race Simulatorhaochenfmhglpholokliifmlpafilfdc- Hercules: Sports Legendhbobdcfpgonejphpemijgjddanoipbkj- Flicking Soccerhdmppejcahhppjhkncagagopecddokpi- Voodoo Magic - Slot Machineheljkmdknlfhiecpknceodpbokeipigo- Web Client for Hockey Shootout - SideGamehiofkndodabpioiheinoiojjobadpgmj- MASTER CHECKERShkbihmjhjmehlocilifheeaeiljabenb- Watercraft Rushhlmdnedepbbihmbddepemmbkenbnoegd- Car Rushhmlnefhgicedcmebmkjdcogieefbaagl- Video Poker Deuces Wildhnpbijogiiaegambgpaenjbcbgaeimlf- Slot Machine Ultimate Socceribelidmkbnjmmpjgfibbdbkamgcbnjdm- Christmas Eve - Slot Machineihbkmfoadnfjgkpdmgcboiehapkiflme- Columbus Voyage - Slot Machineijccacgjefefdpglhclnbpfjlcbagafm- High or Low Casino Gameijfmkphjcogaealhjgijjfjlkpdhhojk- Goalkeeper Challengeijpgccpmogehkjhdmomckpkfcpbjlmnj- Tropical Beach - Slot Machineimjmnghlhiimodfkdkgnfplhlobehnpm- BlackJack 3Djddinhnhplibccfmniaakhffpjpnaglp- Web Client for game Classic Bowlingjmopjanoebpdbopigcbpjhiigmjolikk- Raging Zeus Minesjnmmbmkmbkcccpihjgnhjmhhkokfdnfe- Classic Backgammonjodocbbdcdclkhjkibnlfhbmllcpfkfo- Slot Machine The Fruitskahcolfecjbejjjadhjafmihdnifonjf- Baccaratkblomapfkjidbbbdllmofkcakcenkmec- Mini Golf Worldkbmindomjiejdikjaagfdbdfpnlanobi- Gold Rush - Slot Machinekbnkkecifeppobnemkielnpagifkobki- Pirat Slotkjnakdbpijigdbfepipnbafnhbcfdkga- 40 Imperial Crown - Slot Machinekknakidneabpfgepadgpkibalcnabnnh- 3D Soccer Slot Machineklglejfbdeipgklgaepnodpjcnhaihkd- Premium Horse Racingkmiidcaojgeepjlccoalkdimgpfnbagj- Tanks Gamelcijkepobdokkgmefebkiejhealgblle- Caribbean Stud Pokerlefndgfmmbdklidbkeifpgclmpnhcilg- Wild Buffalo - Slot Machinelfkknbmaifjomagejflmjklcmpadmmdg- Aqua - Slot Machineljbgkfbiifhpgpipepnfefijldolkhlm- Game Crypto Mergelmcpbhamfpbonaenickjclacodolkbdl- Sherwood Forest - Slot Machinelmgenhmehbcolpikplhkoelmagdhoojn- Web Client for game Fatboy Dreammaeccdadgnadblfddcmanhpofobhgfme- Lone Star Jackpots - Slot Machinemedkneifmjcpgmmibfppjpfjbkgbgebl- Hidden Kitty Gamemmbbjakjlpmndjlbhihlddgcdppblpka- Jokers Bonanza - Slot Machinemmbkmjmlnhocfcnjmbchmflamalekbnb- Penalty Kicksnbgligggjfgkpphhghhjdoiefbimgooc- Pai Gow Pokerncpdkpcgmdhhnmcjgiiifdhefmekdcnf- Metal Calculatorndajcmifndknmkckdcdefkpgcodciggk- Farm - Slot Machinenelbpdjegmhhgpfcjclhdmkcglimkjpp- Rail Maze Puzzlenkacmelgoeejhjgmmgflbcdhonpaplcg- RED DOG CARD GAMEnmegibgeklckejdlfhoadhhbgcdjnojb- Coin Miner 2nodobilhjanebkafmpihkpoabiggnnfl- Black Ninja - Slot Machineoanpifaoclmgmflmddlgkikfaggejobn- Pyramid Solitaireocflhkadmmnlbieoiiekfcdcmjcfeahe- Chrome Client for Downhill Ski - SideGameodeccdcabdffpebnfancpkepjeecempn- Slot Machine Mr Chickenoejhnncfanbaogjlbknmlgjpleachclf- Web Client for French Roulette - SideGameogbaedmbbmmipljceodeimlckohbnfan- 3D Roulette Casino Gameojkbafekojdcedacileemekjdfdpkbkf- Slot Machine Space Adventurepdgaknahllnfldmclpcllpieafkaibmf- Whack 'em Allpeflgkmfmoijonfgcjdlpnnfdegnlaji- Video Poker Jacks or Betterphfkdailnomcbcknpdmokejhellbecjb- Swimming Propkghgkfjhjghinikeanecbgjehojfhdg- InterAltpllkanemicadpcmkfodglahcocfdgkhj- Gold of Egypt - Slot Machine
Reference
https://socket.dev/blog/108-chrome-ext-linked-to-data-exfil-session-theft-shared-c2
https://arstechnica.com/security/2025/04/researcher-uncovers-dozens-of-sketchy-chrome-extensions-with-4-million-installs/
