CLMasters

CLMasters is a threat actor associated with a malicious Google Chrome extension marketed as a Meta Business Suite and Facebook Business Manager utility. The operation used a browser extension branded as “CL Suite by @CLMasters” to target Meta business users under the guise of productivity features such as scraping business data, suppressing verification prompts, and generating two-factor authentication codes. The extension covertly exfiltrated highly sensitive authentication and business intelligence data from Meta-related web properties. Reported theft included TOTP seeds, current one-time authentication codes, Facebook account identifiers, Business Manager contact and permissions data, and Business Manager analytics and asset information, including linked accounts and billing-related configuration details. Theft of TOTP seeds is particularly significant because it can neutralize two-factor authentication for follow-on account takeover when paired with credentials obtained through other means. The operation demonstrated capabilities consistent with credential theft, session-adjacent authentication bypass support, reconnaissance, and exfiltration. The extension requested broad access to Meta web domains, harvested victim telemetry and fingerprinting information such as public IP, user agent, operating system, and visited tab context, and transmitted stolen data to attacker-controlled backend services. Reporting also noted optional forwarding of stolen payloads to a Telegram channel controlled by the actor. The code reportedly used silent error handling to reduce visible failures and user suspicion. CLMasters appears focused on compromising high-value Meta Business Manager users and extracting data useful for account compromise, victim profiling, and follow-on abuse of business assets. No direct evidence in the available facts ties the actor to ransomware or destructive activity. The observed operation is most consistent with financially motivated theft and account-compromise enablement.