A coordinated supply chain campaign discovered by Socket's Threat Research Team (researcher Kush Pandya) has identified 108 malicious Chrome extensions operating under a unified command-and-control infrastructure. The extensions are published under five distinct Chrome Web Store publisher identities — Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt — masquerading as Telegram sidebar clients, slot machine and casino games, YouTube/TikTok enhancers, a text translation tool, and browser utilities. Despite the apparent diversity, all 56 unique OAuth2 client IDs across the campaign trace to only two Google Cloud projects (1096126762051 and 170835003632), proving single-operator control.

The campaign employs seven distinct malicious capabilities across overlapping extension subsets:

1. Google OAuth2 Identity Harvesting (54 extensions): Upon user interaction, extensions acquire a real Google OAuth2 Bearer token via chrome.identity.getAuthToken({interactive: true}), then fetch the victim's full profile (email, name, picture, persistent Google account sub identifier) from googleapis.com/oauth2/v3/userinfo and exfiltrate it to mines.cloudapi.stream/auth_google. This creates a persistent reconnaissance database of victim identities linked to extension-specific user IDs.

2. Universal Backdoor via loadInfo() (45 extensions): A hidden function executes automatically on every browser startup before the service worker initializes. It POSTs the extension ID to mines.cloudapi.stream/user_info, and if the C2 returns a URL in the response, opens it in a new tab via chrome.tabs.create(). This gives the operator arbitrary code/page delivery capability on every browser restart. In the Page Locker and Page Auto Refresh extensions, the loadInfo() function uses clean async/await syntax while surrounding code is minified, indicating post-acquisition injection into previously legitimate extensions.

3. innerHTML Injection / DOM-based XSS (78 extensions): A userpage.js file receives C2 responses containing unsanitized HTML that is directly injected via the innerHTML property into leaderboard (result.rating) and Pro Plans (result.protxt) UI sections. This allows the C2 operator to inject arbitrary HTML including script blocks on every extension UI visit.

4. Telegram Session Theft (7 extensions, most critically 'Telegram Multi-account'): The extension injects content scripts at document_start on web.telegram.org to immediately extract the user_auth token from localStorage via getSessionDataJson(). Sessions are transmitted to tg.cloudapi.stream/save_session.php every 15 seconds via a polling loop. The C2 can also push attacker-controlled sessions back to the victim's browser via set_session_changed, replacing the victim's localStorage and forcing a page reload — enabling full account takeover without password or 2FA. A 30-second heartbeat to count_sessions.php gives the operator a live dashboard of available sessions.

5. Security Header Stripping via declarativeNetRequest (5 extensions): CSP, X-Frame-Options, and CSP-Report-Only headers are removed while User-Agent, Origin, and Referer are spoofed and Access-Control-Allow-Origin is set to wildcard. Targets include web.telegram.org (Telegram extensions), youtube.com (YouSide, SideYou), and tiktok.com (Web Client for TikTok). YouTube extensions additionally inject gambling overlays from multiaccount.cloudapi.stream/game.html.

6. Translation Proxy with Content Surveillance (1 extension — Text Translation): Registers users via api.cloudapi.stream:8443/Register with email and name, then proxies all translation text through api.cloudapi.stream:8443/Translation with an API key header, giving the operator full access to all user-submitted text. Notably requests only the sidePanel permission to minimize install warnings.

7. Ad Injection and Monetization (29+ extensions): Gambling banners and overlays injected from multiaccount.cloudapi.stream/game.html into extension sidebars and target websites.

The C2 infrastructure is centralized on a single Contabo GmbH VPS (AS40021) at 144.126.135.238 running a Strapi CMS backend on port 1337 with PostgreSQL on port 5432. The primary domain cloudapi.stream was registered April 30, 2022 via Hosting Ukraine LLC. A secondary domain top.rodeo serves as a game server backend for 71 extensions. The infrastructure uses 14+ specialized subdomains for compartmentalized functions.

Attribution points to a Russian-speaking operator based on transliterated Russian comments in the source code (e.g., "userId ne najden" meaning "userId not found," "Proverka na uzhe avtorizovannogo pol'zovatelya" meaning "Check for already authenticated user"), Kiev-referenced email addresses (kiev3381917@gmail.com, slava.nadejdin.kiev@gmail.com), and Ukrainian hosting infrastructure. The Malware-as-a-Service (MaaS) model is indicated by the topup.cloudapi.stream payment/monetization portal and the staged, modular deployment of capabilities across extension subsets.

As of April 14, 2026, the extensions remain active on the Chrome Web Store. Socket has submitted takedown requests to the Chrome Web Store security team and Google Safe Browsing.