108 Chrome Extensions Steal Google Tokens and Swap Telegram Accounts—Still Live on the Web Store
Security researchers found 108 malicious Chrome extensions silently stealing OAuth2 tokens and hijacking Telegram sessions in a coordinated Russian malware-as-a-service campaign.
- Security researchers found 108 malicious Chrome extensions quietly stealing Google OAuth2 tokens and hijacking Telegram sessions—still live on the Chrome Web Store.
- The extensions are tied to a Russian malware-as-a-service operation using a Contabo VPS to run command-and-control infrastructure across five fake publisher identities.
- One extension steals Telegram session data every 15 seconds and can swap a victim’s account without their knowledge.
Here’s a fun fact about your Chrome browser: some of those extensions you installed three months ago to translate a webpage or watch TikTok ad-free might be silently siphoning your Google credentials to a server in Germany. Security researchers at Socket uncovered 108 coordinated malicious extensions in the Chrome Web Store that steal OAuth2 tokens, deploy backdoors, and hijack Telegram sessions—all part of a single campaign tied to a Russian malware-as-a-service operation.
The numbers are uncomfortable. The largest cluster of 78 extensions injects attacker-controlled HTML directly into the browser interface. Another 54 abuse the chrome.identity.getAuthToken API to harvest victims’ email addresses, names, profile pictures, Google account IDs, and—critically—their OAuth2 Bearer tokens. Those tokens are short-lived access credentials that let applications act on a user’s behalf without requiring a password. Which means stealing one is essentially stealing the keys to someone’s Google account without ever touching their password or two-factor authentication.
A third batch of 45 extensions includes a hidden function that fires on browser startup, contacts the command-and-control server, and can open arbitrary URLs without any user interaction. That’s not an extension feature—that’s a backdoor wearing a browser utility costume.
How 108 Chrome Web Store Extensions Evaded Google’s Review
The campaign ran under five distinct publisher profiles across categories that sound perfectly innocent: Telegram sidebar clients, slot machine and Keno games, YouTube and TikTok enhancers, a text translation tool, and generic browser utilities. The command-and-control infrastructure was hosted on a Contabo VPS—reported Forbes—with multiple subdomains handling session hijacking, identity collection, command execution, and monetization separately. Socket found comments in the code linking the operation to Russian threat actors, calling it a malware-as-a-service play.
The most alarming extension targets Telegram Web. Every 15 seconds, it extracts localStorage content and session tokens, shipping them to the attacker’s server. But it also accepts inbound commands that do the reverse—clearing the victim’s localStorage, overwriting it with attacker-supplied session data, and force-reloading Telegram Web. The result: the victim’s browser is quietly swapped into a different Telegram account without them noticing. If that sounds like a surveillance tool disguised as a sidebar client, you’re reading the room correctly.
Google has not commented on when or whether the extensions will be removed, according to BleepingComputer. At the time Socket published its report, every single one of the 108 extensions was still available for download. Chrome users can check chrome://extensions and compare their installed list against the extension IDs in Socket’s report.
This isn’t the first time browser extensions have turned hostile. Frontierbeat covered LinkedIn’s own extension-scanning practices earlier this month—which now looks less like corporate overreach and more like a reasonable response to exactly this kind of threat. The difference is that LinkedIn was scanning to profile users. These extensions are scanning to steal from them.
The broader pattern is worth noting. AI-powered vulnerability discovery tools like Claude Mythos are finding decades-old security holes in production software. Meanwhile, threat actors are planting fresh ones in the official Chrome Web Store and waiting for Google’s review process to let them through. The asymmetry is not reassuring.
Socket has provided a full list of affected extension IDs. None have been removed as of publication.
