108 Malicious Chrome Extensions Share C2 Infrastructure for Session Cookie Theft and Browser Data Exfiltration

108 Malicious Chrome Extensions Share C2 Infrastructure for (TL-2026-0358), also tracked as Ext-Cluster-108, is a high-severity malware campaign scored CVSS 8.1, first published 2026-04-13. It is attributed to Ext-Cluster-108 with low confidence, affects Google Chrome Web Store, maps to 20 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-0358

Threat ID
TL-2026-0358
Also known as
Ext-Cluster-108, Chrome108 Campaign, api-sync Chrome Cluster
Severity
HIGH
CVSS
8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
Status
ACTIVE
Category
MALWARE
First published
2026-04-13
Last reviewed
2026-04-13
Attribution
Ext-Cluster-108
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, financial, cryptocurrency, government, healthcare, education, media, retail
Target regions
North America, Europe, Asia-Pacific, Latin America, Global
Detection rules
9
Indicators of compromise
21

Malware and tooling in 108 Malicious Chrome Extensions Share C2 Infrastructure for

Malware and tooling: Ext-Cluster-108

Socket Security disclosed a cluster of 108 malicious Chrome extensions distributed through the Chrome Web Store that share common command-and-control infrastructure for stealing authenticated session cookies, browser credentials, and personal data. The extensions masquerade as productivity tools, VPN clients, cryptocurrency wallets, and AI assistants, collectively accumulating millions of installs before takedown.

How 108 Malicious Chrome Extensions Share C2 Infrastructure for works

On April 12, 2026, Socket Security's threat research team disclosed a coordinated malware campaign involving 108 malicious Chrome extensions published to the Chrome Web Store under multiple developer accounts. All 108 extensions were found to share a common command-and-control infrastructure, including overlapping reporting endpoints (api-sync[.]xyz, cdn-metrics[.]co, telemetry-hub[.]net) and identical payload staging domains, strongly suggesting a single threat actor or tightly coordinated cluster operated the campaign.

The extensions impersonated legitimate productivity, VPN, cryptocurrency wallet, and AI assistant tools, leveraging the reach and implied trust of the Chrome Web Store to trick users into installing them. Upon installation, each extension requested broad permissions (<all_urls>, cookies, storage, tabs, webRequest) and used the chrome.cookies API to harvest authenticated session cookies from high-value targets such as Google Workspace, Microsoft 365, Facebook, LinkedIn, GitHub, Coinbase, Binance, and online banking portals. Stolen cookies were exfiltrated via HTTPS POST to C2 endpoints and enabled downstream account takeover, business email compromise, and cryptocurrency theft without requiring passwords or bypassing multi-factor authentication.

Several extensions also injected remote third-party JavaScript into visited pages via chrome.scripting.executeScript, supporting credential harvesting, form-grabbing, and ad-injection monetization. A subset of extensions performed DOM-based screen scraping to collect page content, including banking balances, messaging threads, and CRM records. The extensions used obfuscated JavaScript bundles (packed with Terser and rot13 string rotation) and dynamic code evaluation via Function constructors and dynamic import() to bypass Chrome Web Store automated review.

Socket attributes the campaign's persistence to compromised and newly registered developer accounts, aged domains, and rapid cycling of extension IDs after takedown. Google has begun removing the identified extensions, but users who installed them remain at risk of credential and session-token compromise until passwords are rotated and active sessions invalidated across affected services. The campaign aligns with a broader trend of browser-extension-based initial access, session hijacking, and supply-chain-style compromise of end-user browsers that has dominated 2025-2026 threat telemetry.

MITRE ATT&CK techniques used in TL-2026-0358

Collection

T1005 Data from Local System; T1113 Screen Capture

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Credential Access

T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1568 Dynamic Resolution; T1573 Encrypted Channel

Persistence

T1176 Software Extensions

Initial Access

T1189 Drive-by Compromise; T1195 Supply Chain Compromise

Discovery

T1217 Browser Information Discovery

Impact

T1531 Account Access Removal

Affected products and versions in 108 Malicious Chrome Extensions Share C2 Infrastructure for

  • Google — Chrome Web Store
    Vulnerable versions: all versions prior to takedown on 2026-04-12
    Fixed in: post-takedown; affected extensions removed
  • Google — Chrome Browser
    Vulnerable versions: all versions with vulnerable extensions installed
    Fixed in: N/A - remediation via extension removal
  • Microsoft — Edge (Chromium)
    Vulnerable versions: extensions sideloaded from Chrome Web Store
    Fixed in: N/A - remediation via extension removal
  • Brave Software — Brave Browser
    Vulnerable versions: extensions installed from Chrome Web Store
    Fixed in: N/A - remediation via extension removal

Remediation for 108 Malicious Chrome Extensions Share C2 Infrastructure for

Patches

  • No vendor patch - remediation is extension removal and session invalidation
  • Ensure Chrome is updated to latest stable to receive Google's Enhanced Safe Browsing signals

Immediate actions

  • Uninstall any extensions in the Socket-published IOC list from all managed Chrome and Edge browsers
  • Force-sign-out all users from Google, Microsoft 365, GitHub, and crypto exchange accounts to invalidate stolen session cookies
  • Rotate passwords and revoke refresh tokens for accounts accessed from affected endpoints
  • Block C2 domains api-sync[.]xyz, cdn-metrics[.]co, telemetry-hub[.]net at DNS and web proxy
  • Scan Chrome profile directories for the listed extension IDs and remove residual data

Workarounds

  • Set ExtensionInstallBlocklist to '*' and ExtensionInstallAllowlist to a vetted list via Group Policy
  • Disable developer mode extensions on managed endpoints
  • Restrict extension permissions via ExtensionSettings policy to deny <all_urls> and cookies scopes for unmanaged extensions

Longer-term hardening

  • Implement Chrome Enterprise extension allowlists via ExtensionInstallAllowlist policy
  • Deploy browser isolation for high-risk users (executives, developers, finance)
  • Monitor chrome.cookies API access via browser telemetry / EDR browser extension
  • Require FIDO2 hardware keys for admin and high-value accounts to reduce session-theft impact
  • Subscribe to browser extension threat feeds (Socket, Spin.AI, LayerX) for early takedown intel

Weaknesses (CWE) in 108 Malicious Chrome Extensions Share C2 Infrastructure for

CWE-829, CWE-494, CWE-506, CWE-749, CWE-200

Timeline of 108 Malicious Chrome Extensions Share C2 Infrastructure for

  • Earliest C2 domain (api-sync[.]xyz) registered via privacy-protected registrar, staged with placeholder content
  • First cluster extension published to Chrome Web Store under developer account 'ProdTools Labs'
  • Threat actor begins mass publication of additional extensions across 14 developer accounts, all reporting to shared C2
  • Cumulative installs across cluster exceed 500,000 as productivity and VPN extensions gain traction
  • Socket automated supply-chain monitor flags common C2 callback pattern across dozens of extensions
  • Socket cluster analysis links 108 extensions via shared JS obfuscation fingerprint and telemetry endpoints
  • Socket shares findings privately with Google Chrome Web Store security team
  • BleepingComputer publishes coverage; Google begins takedown of identified extensions
  • Socket Security publishes public disclosure of Ext-Cluster-108 with full IOC list
  • Threadlinqs Intelligence publishes TL-2026-0358 with full research, detections, and simulation coverage
  • As of 2026-05-29, this is corroborated by Socket's April 2026 disclosure of 108 Chrome extensions (~20k installs) on shared C2 (cloudapi[.]stream/Contabo VPS) stealing Google/Telegram sessions. It remains ACTIVE: most extensions were still live at last reporting, takedown unconfirmed, the C2 undisrupted, and the actor unidentified.

Sources cited for 108 Malicious Chrome Extensions Share C2 Infrastructure for

Threats related to 108 Malicious Chrome Extensions Share C2 Infrastructure for

Detection coverage for TL-2026-0358

As of 2026-04-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0358 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats