# 108 Malicious Chrome Extensions Share C2 Infrastructure for Session Cookie Theft and Browser Data Exfiltration

> Socket Security disclosed a cluster of 108 malicious Chrome extensions distributed through the Chrome Web Store that share common command-and-control infrastructure for stealing authenticated session cookies, browser credentials, and personal data. The extensions masquerade as productivity tools, VPN clients, cryptocurrency wallets, and AI assistants, collectively accumulating millions of installs before takedown.

- **Published:** 2026-04-13T12:00:00Z
- **Last reviewed:** 2026-04-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0358
- **ID:** TL-2026-0358
- **Severity:** HIGH (CVSS 8.1)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Ext-Cluster-108
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On April 12, 2026, Socket Security's threat research team disclosed a coordinated malware campaign involving 108 malicious Chrome extensions published to the Chrome Web Store under multiple developer accounts. All 108 extensions were found to share a common command-and-control infrastructure, including overlapping reporting endpoints (api-sync[.]xyz, cdn-metrics[.]co, telemetry-hub[.]net) and identical payload staging domains, strongly suggesting a single threat actor or tightly coordinated cluster operated the campaign.

The extensions impersonated legitimate productivity, VPN, cryptocurrency wallet, and AI assistant tools, leveraging the reach and implied trust of the Chrome Web Store to trick users into installing them. Upon installation, each extension requested broad permissions (<all_urls>, cookies, storage, tabs, webRequest) and used the chrome.cookies API to harvest authenticated session cookies from high-value targets such as Google Workspace, Microsoft 365, Facebook, LinkedIn, GitHub, Coinbase, Binance, and online banking portals. Stolen cookies were exfiltrated via HTTPS POST to C2 endpoints and enabled downstream account takeover, business email compromise, and cryptocurrency theft without requiring passwords or bypassing multi-factor authentication.

Several extensions also injected remote third-party JavaScript into visited pages via chrome.scripting.executeScript, supporting credential harvesting, form-grabbing, and ad-injection monetization. A subset of extensions performed DOM-based screen scraping to collect page content, including banking balances, messaging threads, and CRM records. The extensions used obfuscated JavaScript bundles (packed with Terser and rot13 string rotation) and dynamic code evaluation via Function constructors and dynamic import() to bypass Chrome Web Store automated review.

Socket attributes the campaign's persistence to compromised and newly registered developer accounts, aged domains, and rapid cycling of extension IDs after takedown. Google has begun removing the identified extensions, but users who installed them remain at risk of credential and session-token compromise until passwords are rotated and active sessions invalidated across affected services. The campaign aligns with a broader trend of browser-extension-based initial access, session hijacking, and supply-chain-style compromise of end-user browsers that has dominated 2025-2026 threat telemetry.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1176 Software Extensions
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1568 Dynamic Resolution
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal

## Sources

- [Socket Security - Malicious Chrome Extensions C2 Cluster](https://socket.dev/blog/malicious-chrome-extensions-c2-cluster)
- [BleepingComputer - 108 Malicious Chrome Extensions Linked to Shared C2 Infrastructure](https://www.bleepingcomputer.com/news/security/108-malicious-chrome-extensions-linked-to-shared-c2-infrastructure/)
- [Google Chrome Web Store Developer Policies](https://developer.chrome.com/docs/webstore/program-policies)
- [Chrome Enterprise Extension Management Policies](https://support.google.com/chrome/a/answer/9296680)
- [MITRE ATT&CK - Browser Extensions (T1176)](https://attack.mitre.org/techniques/T1176/)
- [CISA Alert on Session Hijacking and Cookie Theft Mitigations](https://www.cisa.gov/news-events/cybersecurity-advisories)
- [Socket IOC Feed - Ext-Cluster-108](https://socket.dev/feeds/ext-cluster-108)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0358