# 108 Chrome Extensions are secretly stealing your account – Are you on the list of victims? ## Summary of the campaign How did 108 independent Chrome extensions—from text translation apps to seemingly harmless minigames—bypass security censorship and silently manipulate over 20,000 browsers? In-depth analysis reveals that all these extensions are fronts, controlled by a single C2 server network operating under a Malware-as-a-Service (MaaS) model. This sophisticated campaign avoids damaging devices to evade detection; instead, it quietly acts like an undercover scout: permanently hijacking Google OAuth identities, periodically "gutting" Telegram Web login sessions every 15 seconds, and directly inserting a backdoor into the victim's interface. The thought-provoking question for every organization is whether the translation tools or sidebars employees use daily are directly sending internal data to unknown servers. The urgent action now is to review extension installation logs and immediately block the controlling IP range to stop the chain of trust leaks. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/145178c9-7799-4688-a2e2-ed9247b700c6.png align="center") ## Detection and Scope of Impact According to the initial analysis, exactly 108 extensions containing malware have been or are being distributed through the Chrome Web Store. Although carefully disguised and released under the names of five independent publishers, including Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt, all these extensions point to a single backend server system. The exploited extensions cover a wide range, targeting all consumer segments: Telegram chat tools in sidebar form, slot machine gambling software, modules for optimizing YouTube/TikTok resolution, multilingual translation tools, and traditional web display extensions. These malicious programs fully mimic the advertised functionality to deceive users, while the criminal modules... ## The exploitation process ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/1d945823-a62b-4505-87bd-4d84026e3e5f.png align="center") **Initial Access (T1189 - Drive-by Compromise)** Attackers trick victims into installing seemingly legitimate extensions from the official Chrome Web Store to establish a foothold for internal attacks. **Execution (T1059 - Command and Scripting Interpreter)** As soon as the browser starts, hidden scripts (e.g., loadInfo()) and background runtime are invoked to automatically execute data collection cycles using background installation permissions. **Credential Access (T1539 - Steal Web Session Cookie / T1552 - Unsecured Credentials)** Google Account: The extension sends a webhook to call Google's OAuth2 API to request permanent profile data (subject ID, email, name). Telegram Account: The malware actively queries the localStorage variable, periodically extracting the key containing the user\_auth parameter of Telegram Web. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/43a28e6c-98e6-48de-b216-d4a4dd65e0b9.png align="center") **Collection (T1114 - Email Collection/Info Theft)** Text translation tools capture all the victim's language query strings due to their ability to read the text input frame, attach them to the X-Key parameter, and steal them. Every draft and secret message that needs to be copied for translation is recorded. **Command and Control (T1071.001 - Web Protocols)** All data is illicitly transferred via the TLS protocol directly to the subdomains of cloudapi\[.\]stream. The attacker maintains a strong C2 capable of sending custom HTML parameters, inserting a backdoor that forces the browser to load remote URL code without user intervention. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/743b1d24-7e25-44ff-af14-2771b9a521e2.png align="center") ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/1cacbd71-5f74-46c4-9eac-275725ec14e3.png align="center") ## Detailed Technical Analysis ### Steal Telegram session periodically In the group of extensions masquerading as Telegram integration tools (like Telegram Multi-account), the malware injects the target content.js file into the domain https://web.telegram.org/\*. The function getSessionDataJson() scans and exhausts the localStorage area, extracting the web session authentication string and directly transferring it via chrome.runtime.sendMessage(). ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/900cce25-5b92-4c86-97d8-54008df63ecb.png align="center") The level of manipulation by the C2 reaches unpredictable heights with the webhook command set\_session\_changed. After intercepting the request, the server deletes the entire current localStorage and inserts a foreign token. This trick aims to force the victim out of their actual account and use the victim's own browser to log in with a different malicious profile. ### Exploiting Google OAuth2 Identification Instead of attempting phishing for passwords, which carries a high risk of being blocked, 54 extensions in this campaign target Google identity at the infrastructure level. They use the function chrome.identity.getAuthToken to request tokens from users. Once successful, the data sent back to the C2 server includes the permanent sub identifier, along with the email and real name. Collecting the sub index helps the criminals' CRM cross-reference and ensures they never lose track of the user, even if the victim changes their email later. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/f19cd71b-910b-4d27-8651-cd75f15c67a2.png align="center") All Client IDs (about 56 IDs) configured for this purpose belong to only 2 Google Cloud projects: 1096126762051 and 170835003632. This fact alone dispels the facade of separation by the five different publisher names. ### **Universal Backdoor** `loadInfo()` A critical security vulnerability within internal networks lies in the backdoor feature loadInfo(), spread across at least 45 original background configuration files. When Chrome is about to launch, the malware connects to the C2 address. If the response returns a JSON parameter infoURL, the C2 forces the extension to secretly create a tab and immediately redirect the URL. Source analysis shows loadInfo() often uses a concise async/await technique in minified code format, indicating the insertion of external code rather than from a professional original code source. ### Xé Rào Configuration Security Header Instead of attacking webRequest, five extensions have exploited the declarativeNetRequest API (a feature of Manifest V3, known for being more stringent) to strip protection: * Remove the Content-Security-Policy and X-Frame-Options directives from the target website (TikTok, YouTube). * Force the Access-Control-Allow-Origin: \* parameter. * Spoof the User-Agent. When all barriers have collapsed, the malware uses unsafe DOM-injection with the innerHTML variable. This results in automatically injecting junk HTML code and slot machine ads directly into the user interfaces of YouTube and TikTok. ## Command and Control (C2) server infrastructure The backend sketch of the 108 malware network fully reveals the C2 infrastructure located at Contabo GmbH VPS, IP 144.126.135.238. The server architecture uses Strapi CMS with a PostgreSQL data core, organized by subdomain, following a standard Malware-as-a-Service ecosystem. * tg\[.\]cloudapi\[.\]stream: Module exfiltration (Endpoint trace with /save\_session.php). * mines\[.\]cloudapi\[.\]stream: Endpoint for Google identification, providing payload /user\_info for tab-open backdoor. * topup\[.\]cloudapi\[.\]stream: Station issuing paid portal. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/832483b2-bd43-4494-8f75-1473b3460fd6.png align="center") ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/2359b36b-0be3-432f-bd1e-21222ef408a0.png align="center") ## The main impact of the campaign Instead of conducting ransomware encryption or system destruction, this campaign of distributing 108 extensions focuses on gathering intelligence and exploiting long-term trust. The direct impact chain includes: * Silent corporate data leaks (DLP Bypass): Translation and text processing tools are covertly sending all content handled by employees to the C2. This poses a risk of exposing source code, confidential contracts, and business secrets, which DLP solutions find difficult to detect due to packets being encrypted through Chrome's standard TLS layer. * Widespread Account Takeover (ATO): By stealing OAuth tokens directly and extracting localStorage data from Telegram Web, the attacker maintains a backdoor to access internal resources, completely bypassing two-factor authentication (2FA/MFA). This allows them to turn real identity accounts into bait for future internal phishing campaigns. * Exploitation and attack on the local supply chain: With the backdoor loadInfo(), the browsers of tens of thousands of personnel can be commanded by the C2 to open tabs running scripts to DDoS other targets, download OS-level malicious payloads, or simply manipulate displayed content (DOM-injection) to insert financial ads and scams directly onto their work screens. * Serious compliance violations: The overall picture reveals significant weaknesses in the organization's endpoint management (BYOD or lack of Allowlist Extension policy). It threatens strict security standards like ISO 27001 or PCI DSS when devices carry uncontrolled risks. ## Expert opinion The evolution of software in official stores often creates a false sense of security, yet risks are growing in the era of Manifest V3. Many cybersecurity engineers assume that updating Chrome's Manifest V3 will "patch" malware by eliminating the ability to block/modify webRequest packets. On the contrary, this campaign of 108 extensions clearly demonstrates how hackers have perfectly adapted by exploiting the available API—declarativeNetRequest. They blur the line between content moderation and violating Content-Security-Policy. In the bigger picture, this is not an isolated act of individual theft but a smooth criminal business process (MaaS). The backend system manages cross-identity (Google Subject ID), builds Telegram Session warehouses, and maintains a separate payment module, illustrating the remarkably organized scale of this hacker group. The critical point for organizations lies in seemingly benign plugins like "Translation tool." When employees copy and translate regular text (sensitive contracts, code, architectural configurations), they rely on this intermediary channel to silently push data to the hidden /Translation request of the C2. A current Data Loss Prevention (DLP) solution struggles to detect these silent leaks passing through the SSL/HTTPS layer, often mistakenly perceived as a natural application feature. ## Recommendation **Immediate (0-24h)** * Review the DNS filter system, EDR, and web proxy firewall, and ensure the addition of rules to completely deny and block inbound/outbound traffic with domains \*.cloudapi\[.\]stream, top\[.\]rodeo, and IP 144.126.135.238. * Initiate a centralized scan from Endpoint Manager or Active Directory on all devices. Force uninstall if a match is found with the extension ID strings in the whitelist. Simultaneously, force logout (revoke credentials) for any suspicious sessions working with Google. **Short-term (1-7 days)** * Develop SIEM Correlation Rules to hunt for unusual actors, especially user-agent groups with a strong connection history to web.telegram.org or https://www.googleapis.com/oauth2/v3/userinfo not originating from the main Desktop/Web App. * Establish a process to clear caches and local tokens for suspicious users. **Long-term** * Switch entirely from a passive "Blocklist" model to an active "Allowlist" for all extensions operating on devices. The company should approve only plugins from publishers with a trust tier and a publicly available patch repository. Block any interference from extensions to internal domains. ## **MITRE ATT&CK** * T1176 - Browser Extensions * T1539 - Steal Web Session Cookie * T1528 - Steal Application Access Token * T1041 - Exfiltration Over C2 Channel * T1071.001 - Application Layer Protocol: Web Protocols * T1027 - Obfuscated Files or Information * T1185 - Browser Session Hijacking ## **Indicators of Compromise (IOCs)** #### **Email address** * `kiev3381917@gmail[.]com` * `formatron.service@gmail[.]com` * [`nashprom.info`](http://nashprom.info)`@gmail[.]com` * `viktornadiezhdin@gmail[.]com` * `support@top[.]rodeo` * `slava.nadejdin.kiev@gmail[.]com` * `nadejdinv@gmail[.]com` #### **Publisher name** * `Yana Project` * `GameGen` * `SideGames` * `Rodeo Games` * `InterAlt` **Project Credentials** * Google Cloud Project: `1096126762051` * Google Cloud Project: `170835003632` **Network Indicators** * `cloudapi[.]stream` * `tg[.]cloudapi[.]stream` * `mines[.]cloudapi[.]stream` * `topup[.]cloudapi[.]stream` * `cdn[.]cloudapi[.]stream` * `multiaccount[.]cloudapi[.]stream` * `wheel[.]cloudapi[.]stream` * `gamewss[.]cloudapi[.]stream` * `api[.]cloudapi[.]stream` * `chat[.]cloudapi[.]stream` * `crm[.]cloudapi[.]stream` * `top[.]rodeo` * `metal[.]cloudapi[.]stream` * `144[.]126[.]135[.]238` * `coin-miner[.]cloudapi[.]stream` * `goldminer[.]cloudapi[.]stream` * `herculessportslegend[.]cloudapi[.]stream` **C2 Endpoints** * `tg[.]cloudapi[.]stream/save_session.php` * `tg[.]cloudapi[.]stream/count_sessions.php` * `tg[.]cloudapi[.]stream/get_sessions.php` * `tg[.]cloudapi[.]stream/get_session.php` * `tg[.]cloudapi[.]stream/delete_session.php` * `tg[.]cloudapi[.]stream/save_title.php` * `mines[.]cloudapi[.]stream/auth_google` * `mines[.]cloudapi[.]stream/user_info` * `mines[.]cloudapi[.]stream/slot_test/` * `api[.]cloudapi[.]stream:8443/Register` * `api[.]cloudapi[.]stream:8443/Translation` * `top[.]rodeo/server/remote.php` * `top[.]rodeo/server/remote3.php` * `top[.]rodeo/notify.php` * `cloudapi[.]stream/install/` * `cloudapi[.]stream/uninstall/` **Chrome Extension IDs** 1. [`obifanppcpchlehkjipahhphbcbjekfa`](https://socket.dev/chrome/package/obifanppcpchlehkjipahhphbcbjekfa/overview) - Telegram Multi-account 2. [`mdcfennpfgkngnibjbpnpaafcjnhcjno`](https://socket.dev/chrome/package/mdcfennpfgkngnibjbpnpaafcjnhcjno/overview) - Web Client for Telegram - Teleside 3. [`mmecpiobcdbjkaijljohghhpfgngpjmk`](https://socket.dev/chrome/package/mmecpiobcdbjkaijljohghhpfgngpjmk/overview) - YouSide - Youtube Sidebar 4. [`bfoofgelpmalhcmedaaeogahlmbkopfd`](https://socket.dev/chrome/package/bfoofgelpmalhcmedaaeogahlmbkopfd/overview) - Web Client for Youtube - SideYou 5. [`cbfhnceafaenchbefokkngcbnejached`](https://socket.dev/chrome/package/cbfhnceafaenchbefokkngcbnejached/overview) - Web Client for TikTok 6. [`ogogpebnagniggbnkbpjioobomdbmdcj`](https://socket.dev/chrome/package/ogogpebnagniggbnkbpjioobomdbmdcj/overview) - Text Translation 7. [`ldmnhdllijbchflpbmnlgndfnlgmkgif`](https://socket.dev/chrome/package/ldmnhdllijbchflpbmnlgndfnlgmkgif/overview) - Page Locker 8. [`lnajjhohknhgemncbaomjjjpmpdigedg`](https://socket.dev/chrome/package/lnajjhohknhgemncbaomjjjpmpdigedg/overview) - Page Auto Refresh 9. [`aecccajigpipkpioaidignbgbeekglkd`](https://socket.dev/chrome/package/aecccajigpipkpioaidignbgbeekglkd/overview) - Web Client for Rugby Rush - SideGame 10. [`akebbllmckjphjiojeioooidhnddnplj`](https://socket.dev/chrome/package/akebbllmckjphjiojeioooidhnddnplj/overview) - Formula Rush Racing Game 11. [`akifdnfipbeoonhoeabdicnlcdhghmpn`](https://socket.dev/chrome/package/akifdnfipbeoonhoeabdicnlcdhghmpn/overview) - Piggy Prizes - Slot Machine 12. [`akkkopcadaalekbdgpdikhdablkgjagd`](https://socket.dev/chrome/package/akkkopcadaalekbdgpdikhdablkgjagd/overview) - Slot Arabian 13. [`alkfljfjkpiccfgbeocbbjjladigcleg`](https://socket.dev/chrome/package/alkfljfjkpiccfgbeocbbjjladigcleg/overview) - Frogtastic 14. [`alllblhkgghelnejlggmmgjbkdabidie`](https://socket.dev/chrome/package/alllblhkgghelnejlggmmgjbkdabidie/overview) - Black Beard Slot Machine 15. [`amkkjdjjgiiamenbopfpdmjcleecjjgg`](https://socket.dev/chrome/package/amkkjdjjgiiamenbopfpdmjcleecjjgg/overview) - Indian - Slot Machine 16. [`amnaljnjmgajgajelnplfmidgjgbjfhe`](https://socket.dev/chrome/package/amnaljnjmgajgajelnplfmidgjgbjfhe/overview) - Mahjong Deluxe 17. [`bbjdlbemjklojnbifkgameepcafflmem`](https://socket.dev/chrome/package/bbjdlbemjklojnbifkgameepcafflmem/overview) - Crazy Freekick 18. [`bdnanfggeppmkfhkgmpojkhanoplkacc`](https://socket.dev/chrome/package/bdnanfggeppmkfhkgmpojkhanoplkacc/overview) - Slot Car Racing 19. [`bgdkbjcdecedfoejdfgeafdodjgfohno`](https://socket.dev/chrome/package/bgdkbjcdecedfoejdfgeafdodjgfohno/overview) - Clear Cache Plus 20. [`bnchgibgpgmlickioneccggfobljmhjc`](https://socket.dev/chrome/package/bnchgibgpgmlickioneccggfobljmhjc/overview) - Galactica Delux - Slot Machine 21. [`bpljfbcejldmgeoodnogeefaihjdgbam`](https://socket.dev/chrome/package/bpljfbcejldmgeoodnogeefaihjdgbam/overview) - Speed Test for Chrome - WiFi SpeedTest 22. [`cbnekafldflkmngbgmbnfmchjaelnhem`](https://socket.dev/chrome/package/cbnekafldflkmngbgmbnfmchjaelnhem/overview) - Game SkySpeedster 23. [`cdpiopekjeonfjeocbfebemgocjciepp`](https://socket.dev/chrome/package/cdpiopekjeonfjeocbfebemgocjciepp/overview) - Master Chess 24. [`cehdkmmfadpplgchnbjgdngdcjmhlfcc`](https://socket.dev/chrome/package/cehdkmmfadpplgchnbjgdngdcjmhlfcc/overview) - Hockey Shootout 25. [`cljengcehefhflhoahaambmkknjekjib`](https://socket.dev/chrome/package/cljengcehefhflhoahaambmkknjekjib/overview) - Odds Of The Gods - Slot Machine 26. [`clpgopiimdjcilllcjncdkoeikkkcfbi`](https://socket.dev/chrome/package/clpgopiimdjcilllcjncdkoeikkkcfbi/overview) - Billiards Pro 27. [`cmeoegkmpbpcoabhlklbamfeidebgmdf`](https://socket.dev/chrome/package/cmeoegkmpbpcoabhlklbamfeidebgmdf/overview) - Three Card Poker 28. [`cmlbghnlnbjkdgfjlegkbjmadpbmlgjb`](https://socket.dev/chrome/package/cmlbghnlnbjkdgfjlegkbjmadpbmlgjb/overview) - Donuts - Slot Machine 29. [`cnibdhllkgidlgmaoanhkemjeklneolk`](https://socket.dev/chrome/package/cnibdhllkgidlgmaoanhkemjeklneolk/overview) - Archer - Slot Machine 30. [`cpnfioldnmhaihohppoaebillnambcgn`](https://socket.dev/chrome/package/cpnfioldnmhaihohppoaebillnambcgn/overview) - Rugby Rush 31. [`dbohcpohlgnhgjmfkakoniiplglpfhcb`](https://socket.dev/chrome/package/dbohcpohlgnhgjmfkakoniiplglpfhcb/overview) - Bingo 32. [`dcamdpfclondppklabgkfaofjccpioil`](https://socket.dev/chrome/package/dcamdpfclondppklabgkfaofjccpioil/overview) - Web Client for game Cricket Batter Challenge 33. [`dljlpildgknddpnahppkihgodokfjbnd`](https://socket.dev/chrome/package/dljlpildgknddpnahppkihgodokfjbnd/overview) - Slot Machine Zeus Treasures 34. [`dlpiookhionidajbiopmaajeckifeehn`](https://socket.dev/chrome/package/dlpiookhionidajbiopmaajeckifeehn/overview) - Horse Racing 35. [`dmaibhbbpmdihedidicfeigilkbobcog`](https://socket.dev/chrome/package/dmaibhbbpmdihedidicfeigilkbobcog/overview) - Aztec - Slot Machine 36. [`dohenclhhdfljpjlnpjnephpccbdgmmb`](https://socket.dev/chrome/package/dohenclhhdfljpjlnpjnephpccbdgmmb/overview) - Straight 4 37. [`dpdemambcedffmnkfmkephnhhnclmcio`](https://socket.dev/chrome/package/dpdemambcedffmnkfmkephnhhnclmcio/overview) - Slot The Gold Pot 38. [`ejlcbfmhjbkgohopdkijfgggbikgbacb`](https://socket.dev/chrome/package/ejlcbfmhjbkgohopdkijfgggbikgbacb/overview) - American Roulette Royale 39. [`eljfpgehlncincemdmmnebmnlcmfamhm`](https://socket.dev/chrome/package/eljfpgehlncincemdmmnebmnlcmfamhm/overview) - Asia Slot 40. [`enmmilgindjmffoljaojkcgloakmloen`](https://socket.dev/chrome/package/enmmilgindjmffoljaojkcgloakmloen/overview) - Web Client for game Drive Your Car 41. [`eoklnfefipnjfeknpmigmogeeepddcch`](https://socket.dev/chrome/package/eoklnfefipnjfeknpmigmogeeepddcch/overview) - Jurassic Giants - Slot Machine 42. [`fddajeklkkggbnppabbhkdmnkdjindlo`](https://socket.dev/chrome/package/fddajeklkkggbnppabbhkdmnkdjindlo/overview) - Street Basketball 43. [`fibgndhgobbaaekmnneapojgkcehaeac`](https://socket.dev/chrome/package/fibgndhgobbaaekmnneapojgkcehaeac/overview) - Tarot Side Panel 44. [`fjfhejmbhpabkacpoddjbcfandjoacmb`](https://socket.dev/chrome/package/fjfhejmbhpabkacpoddjbcfandjoacmb/overview) - Dragon Slayer - Slot Machine 45. [`flkdjodmoefccepdihipjdlianmkmhgc`](https://socket.dev/chrome/package/flkdjodmoefccepdihipjdlianmkmhgc/overview) - Best Blackjack 46. [`fmajpchoiahphjiligpmghnhmabolhoh`](https://socket.dev/chrome/package/fmajpchoiahphjiligpmghnhmabolhoh/overview) - Book Of Magic - Slot Machine 47. [`gaafhblhbnkekenogcjniofhbicchlke`](https://socket.dev/chrome/package/gaafhblhbnkekenogcjniofhbicchlke/overview) - Snake - Slot Machine 48. [`gbaoddbbpompjhmilbgiaapkkakldlpc`](https://socket.dev/chrome/package/gbaoddbbpompjhmilbgiaapkkakldlpc/overview) - Dice King - Classic Craps And Roll Game 49. [`gbhhgipmedccnankkjchgcidiigmioio`](https://socket.dev/chrome/package/gbhhgipmedccnankkjchgcidiigmioio/overview) - Slot Ramses 50. [`gfhcdakcnpahfdealajmhcapnhhablbp`](https://socket.dev/chrome/package/gfhcdakcnpahfdealajmhcapnhhablbp/overview) - Battleship War 51. [`gipmochingljoikdjakkdolfcbphmlom`](https://socket.dev/chrome/package/gipmochingljoikdjakkdolfcbphmlom/overview) - Gold Miner 2 52. [`glofhphmolanicdaddgkmhfmjidjkaem`](https://socket.dev/chrome/package/glofhphmolanicdaddgkmhfmjidjkaem/overview) - Greyhound Racing - Dog Race Simulator 53. [`haochenfmhglpholokliifmlpafilfdc`](https://socket.dev/chrome/package/haochenfmhglpholokliifmlpafilfdc/overview) - Hercules: Sports Legend 54. [`hbobdcfpgonejphpemijgjddanoipbkj`](https://socket.dev/chrome/package/hbobdcfpgonejphpemijgjddanoipbkj/overview) - Flicking Soccer 55. [`hdmppejcahhppjhkncagagopecddokpi`](https://socket.dev/chrome/package/hdmppejcahhppjhkncagagopecddokpi/overview) - Voodoo Magic - Slot Machine 56. [`heljkmdknlfhiecpknceodpbokeipigo`](https://socket.dev/chrome/package/heljkmdknlfhiecpknceodpbokeipigo/overview) - Web Client for Hockey Shootout - SideGame 57. [`hiofkndodabpioiheinoiojjobadpgmj`](https://socket.dev/chrome/package/hiofkndodabpioiheinoiojjobadpgmj/overview) - MASTER CHECKERS 58. [`hkbihmjhjmehlocilifheeaeiljabenb`](https://socket.dev/chrome/package/hkbihmjhjmehlocilifheeaeiljabenb/overview) - Watercraft Rush 59. [`hlmdnedepbbihmbddepemmbkenbnoegd`](https://socket.dev/chrome/package/hlmdnedepbbihmbddepemmbkenbnoegd/overview) - Car Rush 60. [`hmlnefhgicedcmebmkjdcogieefbaagl`](https://socket.dev/chrome/package/hmlnefhgicedcmebmkjdcogieefbaagl/overview) - Video Poker Deuces Wild 61. [`hnpbijogiiaegambgpaenjbcbgaeimlf`](https://socket.dev/chrome/package/hnpbijogiiaegambgpaenjbcbgaeimlf/overview) - Slot Machine Ultimate Soccer 62. [`ibelidmkbnjmmpjgfibbdbkamgcbnjdm`](https://socket.dev/chrome/package/ibelidmkbnjmmpjgfibbdbkamgcbnjdm/overview) - Christmas Eve - Slot Machine 63. [`ihbkmfoadnfjgkpdmgcboiehapkiflme`](https://socket.dev/chrome/package/ihbkmfoadnfjgkpdmgcboiehapkiflme/overview) - Columbus Voyage - Slot Machine 64. [`ijccacgjefefdpglhclnbpfjlcbagafm`](https://socket.dev/chrome/package/ijccacgjefefdpglhclnbpfjlcbagafm/overview) - High or Low Casino Game 65. [`ijfmkphjcogaealhjgijjfjlkpdhhojk`](https://socket.dev/chrome/package/ijfmkphjcogaealhjgijjfjlkpdhhojk/overview) - Goalkeeper Challenge 66. [`ijpgccpmogehkjhdmomckpkfcpbjlmnj`](https://socket.dev/chrome/package/ijpgccpmogehkjhdmomckpkfcpbjlmnj/overview) - Tropical Beach - Slot Machine 67. [`imjmnghlhiimodfkdkgnfplhlobehnpm`](https://socket.dev/chrome/package/imjmnghlhiimodfkdkgnfplhlobehnpm/overview) - BlackJack 3D 68. [`jddinhnhplibccfmniaakhffpjpnaglp`](https://socket.dev/chrome/package/jddinhnhplibccfmniaakhffpjpnaglp/overview) - Web Client for game Classic Bowling 69. [`jmopjanoebpdbopigcbpjhiigmjolikk`](https://socket.dev/chrome/package/jmopjanoebpdbopigcbpjhiigmjolikk/overview) - Raging Zeus Mines 70. [`jnmmbmkmbkcccpihjgnhjmhhkokfdnfe`](https://socket.dev/chrome/package/jnmmbmkmbkcccpihjgnhjmhhkokfdnfe/overview) - Classic Backgammon 71. [`jodocbbdcdclkhjkibnlfhbmllcpfkfo`](https://socket.dev/chrome/package/jodocbbdcdclkhjkibnlfhbmllcpfkfo/overview) - Slot Machine The Fruits 72. [`kahcolfecjbejjjadhjafmihdnifonjf`](https://socket.dev/chrome/package/kahcolfecjbejjjadhjafmihdnifonjf/overview) - Baccarat 73. [`kblomapfkjidbbbdllmofkcakcenkmec`](https://socket.dev/chrome/package/kblomapfkjidbbbdllmofkcakcenkmec/overview) - Mini Golf World 74. [`kbmindomjiejdikjaagfdbdfpnlanobi`](https://socket.dev/chrome/package/kbmindomjiejdikjaagfdbdfpnlanobi/overview) - Gold Rush - Slot Machine 75. [`kbnkkecifeppobnemkielnpagifkobki`](https://socket.dev/chrome/package/kbnkkecifeppobnemkielnpagifkobki/overview) - Pirat Slot 76. [`kjnakdbpijigdbfepipnbafnhbcfdkga`](https://socket.dev/chrome/package/kjnakdbpijigdbfepipnbafnhbcfdkga/overview) - 40 Imperial Crown - Slot Machine 77. [`kknakidneabpfgepadgpkibalcnabnnh`](https://socket.dev/chrome/package/kknakidneabpfgepadgpkibalcnabnnh/overview) - 3D Soccer Slot Machine 78. [`klglejfbdeipgklgaepnodpjcnhaihkd`](https://socket.dev/chrome/package/klglejfbdeipgklgaepnodpjcnhaihkd/overview) - Premium Horse Racing 79. [`kmiidcaojgeepjlccoalkdimgpfnbagj`](https://socket.dev/chrome/package/kmiidcaojgeepjlccoalkdimgpfnbagj/overview) - Tanks Game 80. [`lcijkepobdokkgmefebkiejhealgblle`](https://socket.dev/chrome/package/lcijkepobdokkgmefebkiejhealgblle/overview) - Caribbean Stud Poker 81. [`lefndgfmmbdklidbkeifpgclmpnhcilg`](https://socket.dev/chrome/package/lefndgfmmbdklidbkeifpgclmpnhcilg/overview) - Wild Buffalo - Slot Machine 82. [`lfkknbmaifjomagejflmjklcmpadmmdg`](https://socket.dev/chrome/package/lfkknbmaifjomagejflmjklcmpadmmdg/overview) - Aqua - Slot Machine 83. [`ljbgkfbiifhpgpipepnfefijldolkhlm`](https://socket.dev/chrome/package/ljbgkfbiifhpgpipepnfefijldolkhlm/overview) - Game Crypto Merge 84. [`lmcpbhamfpbonaenickjclacodolkbdl`](https://socket.dev/chrome/package/lmcpbhamfpbonaenickjclacodolkbdl/overview) - Sherwood Forest - Slot Machine 85. [`lmgenhmehbcolpikplhkoelmagdhoojn`](https://socket.dev/chrome/package/lmgenhmehbcolpikplhkoelmagdhoojn/overview) - Web Client for game Fatboy Dream 86. [`maeccdadgnadblfddcmanhpofobhgfme`](https://socket.dev/chrome/package/maeccdadgnadblfddcmanhpofobhgfme/overview) - Lone Star Jackpots - Slot Machine 87. [`medkneifmjcpgmmibfppjpfjbkgbgebl`](https://socket.dev/chrome/package/medkneifmjcpgmmibfppjpfjbkgbgebl/overview) - Hidden Kitty Game 88. [`mheomooihiffmcgldolenemmplpgoahn`](https://socket.dev/chrome/package/mheomooihiffmcgldolenemmplpgoahn/overview) - Keno 89. [`mmbbjakjlpmndjlbhihlddgcdppblpka`](https://socket.dev/chrome/package/mmbbjakjlpmndjlbhihlddgcdppblpka/overview) - Jokers Bonanza - Slot Machine 90. [`mmbkmjmlnhocfcnjmbchmflamalekbnb`](https://socket.dev/chrome/package/mmbkmjmlnhocfcnjmbchmflamalekbnb/overview) - Penalty Kicks 91. [`nbgligggjfgkpphhghhjdoiefbimgooc`](https://socket.dev/chrome/package/nbgligggjfgkpphhghhjdoiefbimgooc/overview) - Pai Gow Poker 92. [`ncpdkpcgmdhhnmcjgiiifdhefmekdcnf`](https://socket.dev/chrome/package/ncpdkpcgmdhhnmcjgiiifdhefmekdcnf/overview) - Metal Calculator 93. [`ndajcmifndknmkckdcdefkpgcodciggk`](https://socket.dev/chrome/package/ndajcmifndknmkckdcdefkpgcodciggk/overview) - Farm - Slot Machine 94. [`nelbpdjegmhhgpfcjclhdmkcglimkjpp`](https://socket.dev/chrome/package/nelbpdjegmhhgpfcjclhdmkcglimkjpp/overview) - Rail Maze Puzzle 95. [`nkacmelgoeejhjgmmgflbcdhonpaplcg`](https://socket.dev/chrome/package/nkacmelgoeejhjgmmgflbcdhonpaplcg/overview) - RED DOG CARD GAME 96. [`nmegibgeklckejdlfhoadhhbgcdjnojb`](https://socket.dev/chrome/package/nmegibgeklckejdlfhoadhhbgcdjnojb/overview) - Coin Miner 2 97. [`nodobilhjanebkafmpihkpoabiggnnfl`](https://socket.dev/chrome/package/nodobilhjanebkafmpihkpoabiggnnfl/overview) - Black Ninja - Slot Machine 98. [`oanpifaoclmgmflmddlgkikfaggejobn`](https://socket.dev/chrome/package/oanpifaoclmgmflmddlgkikfaggejobn/overview) - Pyramid Solitaire 99. [`ocflhkadmmnlbieoiiekfcdcmjcfeahe`](https://socket.dev/chrome/package/ocflhkadmmnlbieoiiekfcdcmjcfeahe/overview) - Chrome Client for Downhill Ski - SideGame 100. [`odeccdcabdffpebnfancpkepjeecempn`](https://socket.dev/chrome/package/odeccdcabdffpebnfancpkepjeecempn/overview) - Slot Machine Mr Chicken 101. [`oejhnncfanbaogjlbknmlgjpleachclf`](https://socket.dev/chrome/package/oejhnncfanbaogjlbknmlgjpleachclf/overview) - Web Client for French Roulette - SideGame 102. [`ogbaedmbbmmipljceodeimlckohbnfan`](https://socket.dev/chrome/package/ogbaedmbbmmipljceodeimlckohbnfan/overview) - 3D Roulette Casino Game 103. [`ojkbafekojdcedacileemekjdfdpkbkf`](https://socket.dev/chrome/package/ojkbafekojdcedacileemekjdfdpkbkf/overview) - Slot Machine Space Adventure 104. [`pdgaknahllnfldmclpcllpieafkaibmf`](https://socket.dev/chrome/package/pdgaknahllnfldmclpcllpieafkaibmf/overview) - Whack 'em All 105. [`peflgkmfmoijonfgcjdlpnnfdegnlaji`](https://socket.dev/chrome/package/peflgkmfmoijonfgcjdlpnnfdegnlaji/overview) - Video Poker Jacks or Better 106. [`phfkdailnomcbcknpdmokejhellbecjb`](https://socket.dev/chrome/package/phfkdailnomcbcknpdmokejhellbecjb/overview) - Swimming Pro 107. [`pkghgkfjhjghinikeanecbgjehojfhdg`](https://socket.dev/chrome/package/pkghgkfjhjghinikeanecbgjehojfhdg/overview) - InterAlt 108. [`pllkanemicadpcmkfodglahcocfdgkhj`](https://socket.dev/chrome/package/pllkanemicadpcmkfodglahcocfdgkhj/overview) - Gold of Egypt - Slot Machine ## Reference [https://socket.dev/blog/108-chrome-ext-linked-to-data-exfil-session-theft-shared-c2](https://socket.dev/blog/108-chrome-ext-linked-to-data-exfil-session-theft-shared-c2) [https://arstechnica.com/security/2025/04/researcher-uncovers-dozens-of-sketchy-chrome-extensions-with-4-million-installs/](https://arstechnica.com/security/2025/04/researcher-uncovers-dozens-of-sketchy-chrome-extensions-with-4-million-installs/)