Malicious Chrome Extensions Used for Social Media Account Hijacking

Security researchers reported multiple malicious Google Chrome extensions being used to hijack social media accounts by abusing the trust and permissions granted to browser add-ons. One campaign targeted Meta Business users with an extension named “CL Suite by @CLMasters” (jkphinfhmfkckkcnifhjiplhfoiefffl) that requested broad access to meta.com and facebook.com and exfiltrated Facebook Business Manager authentication material and analytics. Analysis indicated the extension captured the TOTP seed and current 6-digit 2FA code when users used its built-in “2FA generator,” then sent associated identifiers (e.g., username/email) to attacker infrastructure at getauth[.]pro, with optional forwarding to Telegram—enabling ongoing generation of valid 2FA codes and increasing the likelihood of high-value ad account takeover.

A separate operation hijacked more than 500,000 VKontakte accounts via five Chrome extensions disguised as VK customization tools (e.g., themes). The extensions manipulated accounts without consent (auto-subscribing victims to attacker-controlled groups, resetting settings periodically, and leveraging VK weaknesses to perform unauthorized actions) and could silently update to receive new malicious code. Researchers attributed the VK-focused activity to a single actor (GitHub alias “2vk”), and at least one extension (VK Styles) was removed from the Chrome Web Store after being flagged, underscoring the ongoing risk of extension-based compromise even when distributed through official marketplaces.