108 Malicious Chrome Extensions Steal OAuth Tokens, Hijack Telegram Sessions, and Deploy Backdoors via Shared C2 Infrastructure — Threadlinqs Intelligence
As of 2026-05-30, 108 Malicious Chrome Extensions Steal OAuth Tokens, Hijack Telegram Sessions, and Deploy Backdoors via Shared C2 Infrastructure is a high-severity supply chain threat attributed to a Russia-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 35 indicators of compromise.
Threat ID: TL-2026-0363 · Severity: HIGH · CVSS: 8.1 · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Russia · FINANCIAL
Socket researchers identified 108 malicious Chrome extensions published under five fake publisher identities in the Chrome Web Store, collectively amassing ~20,000 installs. The extensions steal
A coordinated supply chain campaign discovered by Socket's Threat Research Team (researcher Kush Pandya) has identified 108 malicious Chrome extensions operating under a unified command-and-control infrastructure. The extensions are published under five distinct Chrome Web Store publisher identities — Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt — masquerading as Telegram sidebar clients, slot machine and casino games, YouTube/TikTok enhancers, a text translation tool, and browser utilities. Despite the apparent diversity, all 56 unique OAuth2 client IDs across the campaign trace to only two Google Cloud projects (1096126762051 and 170835003632), proving single-operator control.
The campaign employs seven distinct malicious capabilities across overlapping extension subsets:
1. Google OAuth2 Identity Harvesting (54 extensions): Upon user interaction, extensions acquire a real Google OAuth2 Bearer token via chrome.identity.getAuthToken({interactive: true}), then fetch the victim's full profile (email, name, picture, persistent Google account sub identifier) from googleapis.com/oauth2/v3/userinfo and exfiltrate it to mines.cloudapi.stream/auth_google. This creates a persistent reconnaissance database of victim identities linked to extension-specific user IDs.
2. Universal Backdoor via loadInfo() (45 extensions): A hidden function executes automatically on every browser startup before the service worker initializes. It POSTs the extension ID to mines.cloudapi.stream/user_info, and if the C2 returns a URL in the response, opens it in a new tab via chrome.tabs.create(). This gives the operator arbitrary code/page delivery capability on every browser restart. In the Page Locker and Page Auto Refresh extensions, the loadInfo() function uses clean async/await syntax while surrounding code is minified, indicating post-acquisition injection into previously legitimate extensions.
3. innerHTML Injection / DOM-based XSS (78 extensions): A userpage.js file receives C2 responses containing unsanitized HTML that is directly injected via the innerHTML property into leaderboard (result.rating) and Pro Plans (result.protxt) UI sections. This allows the C2 operator to inject arbitrary HTML including script blocks on every extension UI visit.
4. Telegram Session Theft (7 extensions, most critically 'Telegram Multi-account'): The extension injects content scripts at document_start on web.telegram.org to immediately extract the user_auth token from localStorage via getSessionDataJson(). Sessions are transmitted to tg.cloudapi.stream/save_session.php every 15 seconds via a polling loop. The C2 can also push attacker-controlled sessions back to the victim's browser via set_session_changed, replacing the victim's localStorage and forcing a page reload — enabling full account takeover without password or 2FA. A 30-second heartbeat to count_sessions.php gives the operator a live dashboard of available sessions.
5. Security Header Stripping via declarativeNetRequest (5 extensions): CSP, X-Frame-Options, and CSP-Report-Only headers are removed while User-Agent, Origin, and Referer are spoofed and Access-Control-Allow-Origin is set to wildcard. Targets include web.telegram.org (Telegram extensions), youtube.com (YouSide, SideYou), and tiktok.com (Web Client for TikTok). YouTube extensions additionally inject gambling overlays from multiaccount.cloudapi.stream/game.html.
6. Translation Proxy with Content Surveillance (1 extension — Text Translation): Registers users via api.cloudapi.stream:8443/Register with email and name, then proxies all translation text through api.cloudapi.stream:8443/Translation with an API key header, giving the operator full access to all user-submitted text. Notably requests only the sidePanel permission to minimize install warnings.
7. Ad Injection and Monetization (29+ extensions): Gambling banners and overlays injected from multiaccount.cloudapi.stream/game.html into extension sidebars and target websites.
Weaknesses (CWE)
CWE-79, CWE-200, CWE-319, CWE-352, CWE-829
Target sectors: technology, enterprise, consumer, financial, government, education
Target regions: Global, North America, Europe, Eastern Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 35 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1583, T1583, T1585, T1195, T1059, T1204, T1176, T1036, T1027, T1562