Loading story…
Researchers uncovered a coordinated operation on the Chrome Web Store involving 152 “live wallpaper” new-tab extensions spread across 38 publisher accounts and three backend brands, with roughly 105,000 reported installs. Built from a shared codebase, the extensions redirected install and uninstall traffic to operator-controlled infrastructure and monetized users through ad-driven destination pages including tabplugins.com, yowgames.com, chromewallpaper.com, and owhit.com. Investigators said the campaign functioned as an adware-adjacent traffic-attribution fraud scheme, not a remote-code-execution or classic search-hijacking operation.
A 54-extension subset used a newer template that forged Google organic-search attribution and disguised uninstall activity as legitimate search-result clicks, inflating the apparent value of referral traffic and polluting analytics. The extensions also contained an undisclosed service-worker routine that repeatedly attempted to delete IndexedDB data, a behavior researchers described as anti-forensic even though it did not appear to affect website data outside the extension origin and was ineffective against the campaign’s current local-storage state. The report also cited false Chrome Web Store privacy disclosures and minor data leakage through favicon requests for saved shortcut domains, highlighting ongoing abuse of the browser-extension ecosystem for stealthy ad-fraud operations.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
The research found that 54 newer tabplugins.com extensions used a newer template to forge Google organic-search attribution and disguise uninstall traffic as legitimate search-result clicks. The report also documented an undisclosed IndexedDB deletion routine and contradictory Chrome Web Store privacy disclosures.
Socket's Threat Research Team identified a family of 152 Chrome Web Store live-wallpaper new-tab extensions spread across 38 publisher accounts and three backend brands, with about 105,000 reported installs. The researchers assessed the operation as financially motivated traffic-attribution fraud and commercial adware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
9 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcetechrepublic.com
Open sourcehackread.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcesocket.dev
Open sourcedeveloper.chrome.com
Open sourcedeveloper.chrome.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a coordinated campaign involving **108 malicious Chrome extensions** on the Chrome Web Store that collectively reached about **20,000 installs** and were published under **five separate publisher identities**. The extensions posed as legitimate tools and games but were tied to a shared command-and-control infrastructure, including `cloudapi[.]stream` and backend systems hosted at `144.126.135[.]238`. Investigators linked the operation through reused code, shared privacy-policy artifacts, common Google Cloud project numbers across **54 OAuth-enabled extensions**, and Russian-language comments, indicating a single operator or centrally managed service. The extensions were found stealing **Google account identity data**, **browsing information**, and **Telegram Web sessions**, while some also injected ads, inserted arbitrary JavaScript into visited pages, stripped security headers from sites such as YouTube, TikTok, and Telegram, or used a startup backdoor to open arbitrary URLs. The most severe sample, **Telegram Multi-account**, reportedly exfiltrated Telegram Web session data every 15 seconds and could enable full account takeover by replacing a victim's local session with attacker-supplied data. Researchers said the infrastructure appeared consistent with a **malware-as-a-service** model and warned that many of the extensions were still live when reported; affected users were urged to remove the extensions and revoke active Telegram Web sessions.
Jun 29, 2026
Security researchers reported multiple **malicious browser extension** operations abusing official add-on stores. Socket identified five Chrome Web Store extensions impersonating productivity/security tools for **Workday, NetSuite, and SAP SuccessFactors**, installed over 2,300 times, that performed credential theft and session abuse via **cookie exfiltration**, **cookie injection for session hijacking**, and **DOM manipulation** to block security/incident-response administration pages; the extensions appeared under different publisher names but shared code structure, targeting logic, and infrastructure, indicating coordinated activity. Separately, LayerX documented continued activity in the **GhostPoster** campaign across Chrome, Firefox, and Edge, adding 17 more extensions with a combined ~840,000 installs. The extensions concealed malicious JavaScript in image assets (e.g., logo files) to fetch an obfuscated payload that monitored browsing, planted a backdoor, hijacked affiliate links, and injected invisible iframes to drive **ad/click fraud**; LayerX assessed the operation likely originated in the Edge ecosystem and later expanded, with some extensions reportedly present since 2020, suggesting long-lived persistence despite prior public exposure by Koi Security.
Jun 29, 2026
Security researchers reported multiple **malicious browser-extension** campaigns abusing official extension stores and search-driven lures to compromise enterprise users. Huntress documented a Chrome Web Store extension, **“NexShield – Advanced Web Guardian”** (a near-clone of *uBlock Origin Lite*), distributed via search/advertising redirection and designed to intentionally “freeze” the browser and present a fake **CrashFix** security prompt that instructs users to paste and run commands via `Win + R`; this social-engineering step results in installation of a previously undocumented Windows RAT dubbed **ModeloRAT** on domain-joined endpoints. Reporting also tied the delivery to a traffic distribution system (**KongTuke**, also tracked as **404 TDS/TAG-124** and other aliases) used to profile victims and route them to payload delivery infrastructure that has been leveraged by other criminal operations, including ransomware affiliates. Separately, Socket.dev analysis described **five coordinated Chrome extensions** targeting enterprise SaaS platforms (**Workday, NetSuite, SuccessFactors**) to enable account takeover via **session hijacking**, including continuous token theft and **bidirectional cookie injection** that can bypass MFA by replaying stolen session cookies. In parallel, Malwarebytes reported “sleeper” extension campaigns attributed to **DarkSpectre** (including **GhostPoster** and **ShadyPanda**) that turned previously benign extensions malicious after updates and used **steganography** (JavaScript hidden in extension images) to evade detection across **Edge, Chrome, and Firefox**, with large download counts and long dwell time. A separate Nextron Systems report described a related distribution pattern—malicious “free converter” apps promoted via **malicious Google ads** and made to look legitimate with **code-signing certificates**—highlighting the broader trend of search/advertising-driven initial access leading to persistent RAT deployment, though it is not the same extension-specific incident as the NexShield/CrashFix chain.
Jun 29, 2026