108 Chrome Extensions Stole Google Identities and Telegram Sessions

Researchers uncovered a coordinated campaign involving 108 malicious Chrome extensions on the Chrome Web Store that collectively reached about 20,000 installs and were published under five separate publisher identities. The extensions posed as legitimate tools and games but were tied to a shared command-and-control infrastructure, including cloudapi[.]stream and backend systems hosted at 144.126.135[.]238. Investigators linked the operation through reused code, shared privacy-policy artifacts, common Google Cloud project numbers across 54 OAuth-enabled extensions, and Russian-language comments, indicating a single operator or centrally managed service.

The extensions were found stealing Google account identity data, browsing information, and Telegram Web sessions, while some also injected ads, inserted arbitrary JavaScript into visited pages, stripped security headers from sites such as YouTube, TikTok, and Telegram, or used a startup backdoor to open arbitrary URLs. The most severe sample, Telegram Multi-account, reportedly exfiltrated Telegram Web session data every 15 seconds and could enable full account takeover by replacing a victim's local session with attacker-supplied data. Researchers said the infrastructure appeared consistent with a malware-as-a-service model and warned that many of the extensions were still live when reported; affected users were urged to remove the extensions and revoke active Telegram Web sessions.