108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure
Essential information
- Published
- 14/04/2026 17:38
- Modified
- 14/04/2026 15:50
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- browser backdoor chrome extensions google identity theft session hijacking
- Tags
- 2026-04-14 browser backdoor chrome extensions google identity theft session hijacking
- Related entities
- 40 indicators, 40 observables, 20 techniques (mitre), 22 others
Description
A coordinated campaign of 108 malicious Chrome extensions operated through shared command-and-control infrastructure at cloudapi[.]stream has been identified, collectively accounting for approximately 20,000 installations. The campaign spans multiple threat categories: 54 extensions steal Google account identities via OAuth2, one extension actively exfiltrates Telegram Web sessions every 15 seconds, and 45 extensions contain a universal backdoor enabling arbitrary URL execution on browser startup. Published under five distinct publisher identities (Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt), these extensions masquerade as legitimate tools including Telegram sidebar clients, slot games, YouTube and TikTok enhancers, and translation utilities. All extensions route stolen credentials, user identities, and browsing data to servers controlled by the same operator, with infrastructure confirming a Malware-as-a-Service business model.