Threat reportSupply ChainTL-2026-0081
Malicious Chrome Extension CL Suite Steals Meta Business Manager Data & TOTP 2FA Seeds
Malicious Chrome Extension CL Suite Steals Meta Business (TL-2026-0081) is a high-severity supply-chain compromise, first published 2026-02-13. It is attributed to CLMasters with low confidence, maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 12 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 24MITRE ATT&CK
- Actors
- 1CLMasters
- Detection rules
- 12SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-0081
- Threat ID
- TL-2026-0081
- Severity
- HIGH
- Status
- PATCHED
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- CLMasters
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- Marketing, Advertising, Small Business, E-commerce, Media, Digital Marketing Agencies
- Target regions
- Global
- Detection rules
- 12
- Indicators of compromise
- 29
How Malicious Chrome Extension CL Suite Steals Meta Business works
Malicious Chrome extension 'CL Suite' by @CLMasters discovered stealing Meta Business Manager data and TOTP 2FA seeds, enabling persistent account takeover of Facebook/Meta business advertising accounts.
Socket Security researchers discovered a malicious Chrome extension named 'CL Suite' published by @CLMasters that specifically targets Meta (Facebook) Business Manager users. The extension masquerades as a productivity tool for managing Facebook business operations but covertly exfiltrates sensitive data including Business Manager contact lists, advertising analytics data, and critically, TOTP (Time-based One-Time Password) 2FA seed secrets. By stealing TOTP seeds rather than individual OTP codes, the attacker gains PERSISTENT 2FA bypass capability — they can generate valid authentication codes indefinitely without re-compromising the victim. This is significantly more dangerous than session cookie theft because it survives password resets, session invalidations, and device changes. The extension uses Chrome's content script injection capabilities to interact with Facebook/Meta Business Manager pages, scraping DOM elements containing business data, injecting JavaScript to intercept API responses, and hooking into the 2FA enrollment/management flow to capture TOTP secret keys during setup or viewing. Exfiltrated data is sent to attacker-controlled infrastructure. Meta Business Manager accounts control advertising spend (often $10K-$1M+/month), ad creative management, audience data, and business page administration. Compromised accounts enable: (1) unauthorized ad spend on attacker-controlled campaigns (cryptoscam/malware distribution ads), (2) business intelligence theft (competitor targeting data, customer audiences), (3) brand impersonation through controlled business pages, (4) lateral access to connected Instagram, WhatsApp Business, and Messenger accounts. This attack fits the established pattern of Vietnamese and Chinese threat actors targeting Facebook Business accounts via malicious browser extensions, a category that has generated hundreds of millions of dollars in fraud since 2022.
MITRE ATT&CK techniques used in TL-2026-0081
collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1185 Browser Session Hijacking; T1213 Data from Information Repositories
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
discovery
T1069 Permission Groups Discovery; T1087 Account Discovery; T1526 Cloud Service Discovery
credential-access
T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
persistence
initial-access
impact
T1531 Account Access Removal; T1657 Financial Theft
resource-development
T1585 Establish Accounts; T1588 Obtain Capabilities; T1608 Stage Capabilities
Remediation for Malicious Chrome Extension CL Suite Steals Meta Business
Immediate actions
- Remove 'CL Suite' extension from all Chrome browsers immediately
- Revoke all active Facebook/Meta Business Manager sessions
- Rotate all TOTP 2FA seeds — old seeds are compromised and must be regenerated
- Review Meta Business Manager audit logs for unauthorized access
- Check for unauthorized ad campaigns or budget modifications
- Review and remove any unrecognized Business Manager administrators or partners
Workarounds
- Use Meta Business Manager in Firefox or Safari where the malicious extension cannot run
- Access Meta Business Manager via mobile app instead of browser
- Use Chrome's Incognito mode with no extensions enabled for Meta Business Manager access
Longer-term hardening
- Implement browser extension allowlisting via Chrome Enterprise policies
- Use hardware security keys (FIDO2/WebAuthn) instead of TOTP for Meta Business Manager 2FA
- Enable Meta Business Manager login alerts and suspicious activity notifications
- Implement separation of duties — limit who can install browser extensions on machines with Meta BM access
- Regular audit of installed Chrome extensions across organization
- Consider using Meta Business Manager only in dedicated browser profiles with no third-party extensions
Weaknesses (CWE) in Malicious Chrome Extension CL Suite Steals Meta Business
Timeline of Malicious Chrome Extension CL Suite Steals Meta Business
- Malicious Chrome extensions targeting Facebook Business accounts emerge as a major threat category, with multiple Vietnamese and Chinese threat actors distributing hundreds of extensions. Source: Multiple security vendors
- Guardio Labs discovers 'FakeGPT' — malicious ChatGPT-themed Chrome extension stealing Facebook Business accounts via session cookie theft. Established template for Meta BM targeting extensions. Source: Guardio Labs
- Meta and Google intensify coordinated takedowns of malicious Chrome extensions targeting Business Manager, but new variants continue to emerge faster than removal. Source: Meta Security Team
- Threat actors evolve from session cookie theft to TOTP seed theft, providing persistent 2FA bypass that survives session invalidation and password resets. Source: Socket Security
- Socket Security researchers identify malicious Chrome extension 'CL Suite' by @CLMasters targeting Meta Business Manager data and TOTP 2FA seeds. Source: https://socket.dev/blog/malicious-chrome-extension-steals-meta-business-manager-exports-and-totp-2fa-seeds
- Researcher qcontinuum1 discovers 287 Chrome extensions exfiltrating browsing history from 37.4 million users, highlighting the scale of malicious Chrome extension ecosystem. Source: https://cybersecuritynews.com/chrome-extensions-exfiltrate-browsing-history/
- ThreadLinqs Intelligence begins tracking CL Suite as TL-2026-0081 after RSS detection. Extension targets Meta Business Manager exports and TOTP 2FA seeds for persistent account takeover. Source: ThreadLinqs Intelligence
- As of 2026-05-29, the CL Suite extension's distribution vector is neutralized: it has been removed from the Chrome Web Store following Socket Security's Feb 13 disclosure (live + reported at publication), and its C2 getauth[.]pro TLS cert lapsed in April 2026. No CVE applies (malicious-extension supply-chain); residual risk is the actor retaining already-stolen TOTP seeds, not active distribution.
Sources cited for Malicious Chrome Extension CL Suite Steals Meta Business
- Malicious Chrome Extension CL Suite Steals Meta Business Manager Exports and TOTP 2FA Seeds
- Chrome Web Store Developer Program Policies
- Meta Business Help Center — Account Security
- 287 Chrome Extensions Exfiltrate Browsing History From 37.4 Million Users
- TOTP: Time-Based One-Time Password Algorithm (RFC 6238)
Detection coverage for TL-2026-0081
As of 2026-02-13, Threadlinqs Intelligence publishes 12 detection rule(s) for TL-2026-0081 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.