2vk

2vk is a threat actor associated with a large-scale browser-extension campaign targeting VKontakte users through malicious Chrome extensions disguised as VK customization and theme tools. The operation has been linked to the extension cluster commonly referred to as VK Styles and was active from at least June 2025 through January 2026. The actor used a two-stage delivery chain designed to evade marketplace review and static detection: infected extensions retrieved encoded instructions from metadata on an attacker-controlled VK profile and then fetched additional obfuscated JavaScript from a GitHub repository controlled by the actor. The downloaded code was injected into VK pages visited by victims, enabling continuous updates to malicious functionality without republishing the extension packages. The campaign hijacked authenticated VK sessions and abused platform security mechanisms to perform unauthorized actions on behalf of victims. Reported behaviors included forced subscriptions to attacker-controlled VK groups, periodic resetting of account settings to preserve control, and manipulation of CSRF-related protections and session context to sustain access. The extensions silently updated, allowing iterative refinement and expansion of capabilities over time. At least five related extensions shared the same infrastructure, and the operation reportedly affected more than 500,000 users, primarily among Russian-speaking communities across Eastern Europe, Central Asia, and the broader Russian diaspora. The campaign appears primarily financially or growth motivated through artificial audience building and monetizable control of user accounts, rather than espionage.