Fake Madgicx Plus and SocialMetrics extensions steal Meta accounts

Cybersecurity researchers have uncovered two new campaigns promoting fake browser extensions, using malicious ads and fake websites to steal sensitive data from Meta accounts.

According to Bitdefender, the malicious ad campaign is designed to promote fake browser extensions called SocialMetrics Pro, which supposedly unlock the blue verification badge for profiles on Meta and Instagram.

See also: Former WhatsApp security chief sues Meta

At least 37 malicious ads serving the extension in question have been observed. “The malicious ads are accompanied by a video tutorial that guides viewers through the process of downloading and installing a so-called browser extension, which supposedly unlocks the blue verification badge on Facebook or other special features,” the Romanian cybersecurity provider said.

However, the extension – which is hosted on a legitimate cloud service called Box – is capable of collecting session cookies from Facebook and sending them to a bot on Telegram controlled by the attackers. It can also obtain the victim’s IP address by sending a query to ipinfo[.]io/json. Selected variants of the malicious browser add-on have been observed using the stolen cookies to interact with the Facebook Graph API, likely to extract additional information about accounts.

See also: Singapore v. Meta: Injunction to curb fraud on Facebook

In the past, malware like NodeStealer has leveraged the Facebook Graph API to harvest account budget details. The ultimate goal of these efforts is to sell valuable Facebook Business and Ads accounts on underground forums for profit to other scammers or reuse them to fuel more malicious ad campaigns, leading to more compromised accounts – essentially creating a self-perpetuating cycle.

The campaign features all the “fingerprints” typically associated with Vietnamese-speaking threat actors, who are known to adopt various stealer families to target and gain unauthorized access to Facebook accounts. This hypothesis is also reinforced by the use of Vietnamese language for the guide’s narration and source code annotations.

See also: New agreement between Google and Meta in the cloud industry

Another campaign targets Meta advertisers with malicious Chrome extensions distributed via fake websites that present themselves as AI-powered ad optimization tools for Facebook and Instagram. At the heart of the operation is a fake platform called Madgicx Plus. Once installed, the extension gains full access to all websites the user visits, allowing attackers to inject arbitrary scripts, modify network traffic, monitor browsing activity, record form inputs, and collect sensitive data. It also prompts users to connect their Facebook and Google accounts to access the service.