What happens when one malicious actor hides inside 108 different browser extensions and speaks to a single command-and-control system? Cybersecurity researchers say the answer is a campaign that can quietly harvest user data and turn every web page a victim visits into a vector for ad injection and arbitrary code execution — and that, according to reports, around 20,000 users may already be affected.
The discovery
Cybersecurity researchers have discovered a new campaign in which a cluster of 108 Google Chrome extensions has been found to communicate with the same command-and-control (C2) infrastructure. According to Socket, the extensions share that common C2 connection and are built with the goal of collecting user data and enabling browser-level abuse by injecting ads and arbitrary JavaScript code into every web page visited.
Scope and technique
The researchers describe the operation as coordinated: a large number of extensions behaving as one, controlled by a single backend. The campaign has been reported to steal Google and Telegram data and to affect roughly 20,000 users, turning ostensibly benign browser add-ons into tools for data collection and page-level manipulation.
Why this matters
At a technical level, the combination of wide distribution (many extensions), a single C2, and the ability to inject arbitrary JavaScript means an adversary can both collect credentials or tokens exposed in the browser and alter user browsing sessions in real time. For users, that can translate into unwanted ads, altered page content, and the theft of account-related data. For browser-extension ecosystems, the pattern shows how individual components can be weaponized at scale when they share backend infrastructure.
Perspectives and trade-offs
- Technologists: The campaign highlights the difficulty of detecting malicious behavior that is distributed across many small, innocuously named extensions yet unified by common command-and-control infrastructure.
- Policymakers: The emergence of large, coordinated extension campaigns raises questions about vetting, monitoring and enforcement in browser extension marketplaces.
- Users: The incident underscores risks associated with browser extensions broadly — even widely trusted platforms can be exploited when extensions are co-opted to perform harmful actions.
- Adversaries: The model — many front-facing components controlled by a single backend — is attractive because it spreads risk and complicates takedown and attribution efforts.
The contours of this campaign are clear in the reporting: many extensions, one C2, the ability to siphon data and to manipulate pages in real time. The remaining questions — how long the activity went unnoticed, how the extensions were distributed, and what remediation steps will be effective — are the ones defenders and platform operators now must answer. If dozens of innocuous browser add-ons can be marshaled into a single data-harvesting engine, what other everyday software components might be repurposed next?
https://thehackernews.com/2026/04/108-malicious-chrome-extensions-steal.html
