Loading malware…
CL Suite (marketed as “CL Suite by @CLMasters,” Chrome extension ID: jkphinfhmfkckkcnifhjiplhfoiefffl) is a malicious Google Chrome extension posing as a Meta Business Suite/Facebook Business Manager utility (e.g., scraping Meta Business Suite data, removing verification pop-ups, and generating 2FA codes). Despite privacy-policy claims that 2FA secrets and Business Manager data remain local, the extension exfiltrates sensitive authentication material and business intelligence from meta.com and facebook.com.
High-confidence capabilities and behavior described:
Infection vector / distribution:
Targeting and impact:
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Socket’s Threat Research Team identified a malicious Google Chrome extension CL Suite by @CLMasters (extension ID jkphinfhmfkckkcnifhjiplhfoiefffl), that… exfiltrates TOTP seeds, 2FA codes, Business Manager contact lists, and analytics data to infrastructure controlled by the threat actor.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
"packages sensitive data, including... Facebook usernames and emails" and "Names and email addresses of Business Manager users"
"fingerprints the client’s public IP... fetch('https://api.ipify.org?format=json')"
"exfiltrated Business Manager data includes names, emails, access levels, and associated ad accounts"
"identified a malicious Google Chrome extension... that... behind the scenes, exfiltrates TOTP seeds, 2FA codes..." and "extension remains live... on the Chrome Web Store"
"Across multiple modules, the extension packages sensitive data... and sends it to a telemetry API" and code examples in background scripts and feature modules
"marketed as a way to scrape Meta Business Suite data..."; "extensions masquerading as VK customization tools"; "advertised as artificial intelligence (AI) assistants"
"malicious Google Chrome extension CL Suite... requests broad access to meta.com and facebook.com"
"exfiltrates TOTP seeds, 2FA codes... By stealing TOTP seeds and codes... effectively neutralizes 2FA protection"
"exfiltrates TOTP seeds, 2FA codes... By stealing TOTP seeds and codes... effectively neutralizes 2FA protection"
"transmits TOTP seeds and current one-time security codes"; "Steal TOTP seed... and 2FA code"
"exfiltrates TOTP seeds, 2FA codes... By stealing TOTP seeds and codes... effectively neutralizes 2FA protection"
"...exfiltrates TOTP codes for Facebook and Meta Business accounts..."; "...transmits TOTP seeds and current one-time security codes..."
"collects Facebook account identifiers, 2FA seeds and codes, CSV exports, tab URL, public IP, and user agent"
"transmits TOTP seeds and current one-time security codes"; "Steal TOTP seed... and 2FA code"
"walks the DOM, extracts table rows, and builds a CSV" and "enumerates Business Manager-level entities and their linked assets"
"Target Business Manager 'People' view ... and build a CSV file with names, email addresses, roles and permissions..."; "Enumerate Business Manager-level entities and their linked assets and build a CSV file..."
"POSTs the result to API_ENDPOINT with an Authorization: Bearer <API_KEY> header" and endpoints at "https://getauth[.]pro/api/..."
"...transmits TOTP seeds and current one-time security codes ... to a backend at getauth[.]pro, with an option to forward the same payloads to a Telegram channel controlled by the threat actor."; "...transmitted to third-party backend infrastructure controlled by the extension operator"
"the code transmits TOTP seeds and current one-time security codes ... to a backend at getauth[.]pro, with an option to forward the same payloads to a Telegram channel"
"with an option to forward the same payloads to a Telegram channel controlled by the threat actor."
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.