Loading story…
Researchers reported that the StealTok campaign used at least 12 malicious browser extensions on the Chrome and Microsoft Edge stores that posed as TikTok video downloaders while covertly harvesting user data. The extensions shared a common Manifest V3 codebase and relied on attacker-controlled remote configuration, allowing operators to alter behavior after installation. More than 130,000 users were affected over the life of the campaign, and roughly 12,500 installations remained active at the time of reporting; some of the add-ons had even been labeled "Featured" in official marketplaces, helping them appear legitimate.
The operation reportedly ran for more than a year and often kept extensions benign for six to 12 months before enabling information-stealing functions, a tactic that helped evade store review and build trust. Collected data included browsing and usage telemetry, TikTok content interaction, language and timezone settings, user-agent details, and battery status, giving attackers a strong fingerprint of victims’ environments. Researchers said the campaign appeared to be run by a single actor or tightly coordinated group using cloning, rebranding, and rapid redeployment to survive takedowns, and warned the same infrastructure could be expanded for broader data theft, session abuse, or proxy-style botnet activity.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
LayerX published research identifying the coordinated StealTok campaign and said more than 130,000 users had been compromised across Chrome and Edge. At the time of analysis, about 12,500 active installations remained, and some malicious extensions were still available in official stores, including several marked as featured.
After remaining benign for roughly 6 to 12 months to evade marketplace review, many of the TikTok downloader extensions were updated with information-stealing and tracking capabilities. The extensions began collecting telemetry and fingerprinting data such as usage patterns, language, timezone, user agent, and battery status.
LayerX reported that the StealTok campaign had been active for more than a year, using at least 12 Chrome and Microsoft Edge extensions disguised as TikTok video downloaders. The operation relied on a shared codebase, cloning, rebranding, and attacker-controlled remote configuration to persist across store removals.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourceinfosec.pub
Open sourcescworld.com
Open sourcelayerxsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a coordinated campaign involving **108 malicious Chrome extensions** on the Chrome Web Store that collectively reached about **20,000 installs** and were published under **five separate publisher identities**. The extensions posed as legitimate tools and games but were tied to a shared command-and-control infrastructure, including `cloudapi[.]stream` and backend systems hosted at `144.126.135[.]238`. Investigators linked the operation through reused code, shared privacy-policy artifacts, common Google Cloud project numbers across **54 OAuth-enabled extensions**, and Russian-language comments, indicating a single operator or centrally managed service. The extensions were found stealing **Google account identity data**, **browsing information**, and **Telegram Web sessions**, while some also injected ads, inserted arbitrary JavaScript into visited pages, stripped security headers from sites such as YouTube, TikTok, and Telegram, or used a startup backdoor to open arbitrary URLs. The most severe sample, **Telegram Multi-account**, reportedly exfiltrated Telegram Web session data every 15 seconds and could enable full account takeover by replacing a victim's local session with attacker-supplied data. Researchers said the infrastructure appeared consistent with a **malware-as-a-service** model and warned that many of the extensions were still live when reported; affected users were urged to remove the extensions and revoke active Telegram Web sessions.
Jun 29, 2026
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026
A malware campaign abused **malicious Chrome extensions** to compromise users and steal data, including a set of VKontakte-themed extensions that hijacked accounts at scale. Researchers reported that five related extensions (notably **“VK Styles”**, which reportedly reached ~400,000 installs before removal) were used to silently take over VKontakte accounts by subscribing victims to attacker-controlled groups, resetting settings on a recurring basis, and manipulating tokens to maintain persistence. The operation used a **two-stage** approach to evade detection: extensions fetched instructions/payload locations from a VKontakte profile’s HTML metadata and then executed attacker-controlled code retrieved from external infrastructure (including a GitHub account reportedly tied to the actor). Separately, threat reporting highlighted a broader ecosystem issue in which **300+ malicious Chrome extensions** with tens of millions of combined downloads were identified leaking or stealing user data, reinforcing the ongoing risk posed by browser extension supply-chain abuse. In contrast, Google also issued an urgent patch for an actively exploited Chrome zero-day, **CVE-2026-2441** (*use-after-free in CSS*), but that vulnerability disclosure is a distinct event from the extension-based account takeover activity and should be tracked independently for patching and exposure management.
Jun 29, 2026