Loading threat actor…
2vk is a threat actor associated with a large-scale browser-extension campaign targeting VKontakte users through malicious Chrome extensions disguised as VK customization and theme tools. The operation has been linked to the extension cluster commonly referred to as VK Styles and was active from at least June 2025 through January 2026. The actor used a two-stage delivery chain designed to evade marketplace review and static detection: infected extensions retrieved encoded instructions from metadata on an attacker-controlled VK profile and then fetched additional obfuscated JavaScript from a GitHub repository controlled by the actor. The downloaded code was injected into VK pages visited by victims, enabling continuous updates to malicious functionality without republishing the extension packages. The campaign hijacked authenticated VK sessions and abused platform security mechanisms to perform unauthorized actions on behalf of victims. Reported behaviors included forced subscriptions to attacker-controlled VK groups, periodic resetting of account settings to preserve control, and manipulation of CSRF-related protections and session context to sustain access. The extensions silently updated, allowing iterative refinement and expansion of capabilities over time. At least five related extensions shared the same infrastructure, and the operation reportedly affected more than 500,000 users, primarily among Russian-speaking communities across Eastern Europe, Central Asia, and the broader Russian diaspora. The campaign appears primarily financially or growth motivated through artificial audience building and monetizable control of user accounts, rather than espionage.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operated a malicious Chrome-extension campaign masquerading as VKontakte customization tools (e.g., theme changers) to hijack VK accounts at scale (~500k installs). The extensions abused authenticated VK sessions to take over accounts, force-subscribe victims to attacker-controlled groups to amplify reach, reset user settings periodically, and silently auto-update to push new malicious code. Also monetized via paid theme/features while continuing account abuse.
Operates a large-scale malicious Chrome extension campaign targeting VKontakte users. The extensions masquerade as VK customization tools (e.g., 'VK Styles') and perform account takeover behaviors: persistent code injection on VK pages, retrieval of instructions from attacker-controlled VK profile metadata (used as C2), downloading/execing additional payloads from an attacker-controlled GitHub repo, manipulating VK CSRF cookies/tokens to automate unauthorized actions, and forcing victims to subscribe to attacker-controlled VK groups to aid propagation. Activity described as continuous from June 2025 through January 2026 with iterative development via GitHub commits.
Runs the “VK Styles” malicious-extension campaign that hijacks VKontakte accounts at scale via Chrome extensions masquerading as VK customization/music tools; uses injected/obfuscated JavaScript to manipulate accounts (forced group subscriptions, settings resets), bypass protections via CSRF token manipulation, and maintain persistence; uses GitHub-hosted next-stage payloads and a VK profile metadata dead-drop resolver for C2/payload URL indirection.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.