Malicious Chrome Extension Exfiltrates Meta Business Data and TOTP 2FA Seeds

Researchers reported a malicious Google Chrome extension, CL Suite (publisher @CLMasters, extension ID jkphinfhmfkckkcnifhjiplhfoiefffl), that targets users of Meta Business Suite and Facebook Business Manager by masquerading as a tool to scrape business data, remove verification pop-ups, and generate 2FA codes. Although its listing and privacy policy claim sensitive data remains local, analysis found the extension requests broad access to meta.com and facebook.com and covertly collects TOTP seeds, current 2FA codes, Business Manager “People” exports (CSV), contact lists, and analytics data.

The stolen data is exfiltrated to attacker-controlled infrastructure at getauth[.]pro, with an option to forward the same payloads to an attacker-controlled Telegram channel. By capturing TOTP seeds and one-time codes, the extension can effectively neutralize 2FA, enabling account takeover when paired with passwords obtained elsewhere (e.g., infostealer logs or credential dumps). The exposure can persist even after uninstall because the attacker retains the exported business intelligence and 2FA seeds; Socket stated it notified Google and flagged the extension for removal, while reporting indicated the extension had a limited user base at the time of analysis.