Malicious Chrome extensions steal data, emails and browsing history

Cybersecurity researchers have discovered a malicious extension for Google Chrome that is designed to steal data related to Meta Business Suite and Facebook Business Manager.

See also: Chrome extensions abuse links and steal access to ChatGPT

The extension, called CL Suite by @CLMasters (ID: jkphinfhmfkckkcnifhjiplhfoiefffl), is promoted as a tool for extracting data from Meta Business Suite, removing verification pop-ups, and generating two-factor authentication (2FA) codes. It was initially uploaded to the Chrome Web Store on March 1, 2025, and has 33 users so far.

However, this add-on also exports TOTP codes for Facebook and Meta Business accounts, Business Manager contact lists, and analytics data to infrastructure controlled by the threat actor, as reported by Socket.

Targeting users of Meta Business Suite and Facebook Business Manager, the threat actor has exploited the extension to conduct data collection and extraction without the users' knowledge or consent.

Although the extension does not have the capabilities to steal password-related information, the attacker could obtain such information from other sources, such as infostealer logs or credential dumps, and then use the stolen passwords to gain unauthorized access to victims' accounts.

See also: Chrome 144 fixes vulnerability in V8 JavaScript engine

The full range of capabilities of the malicious plugin includes:

• Theft of TOTP seeds (unique, alphanumeric codes used to generate time-based one-time passwords) and 2FA codes.
• Target the “People” view of Business Manager by navigating to facebook[.]com and meta[.]com and creating a CSV file with names, email addresses, roles, permissions, status, and access details.
• Count Business Manager-level entities and their linked assets, create a CSV file with Business Manager IDs and names, linked ad accounts, linked pages and assets, and billing and payment configuration details.

Socket warned that despite the low number of installations, the extension provides the threat actor with enough information to identify high-value targets and organize subsequent attacks.

In a related discovery, Koi Security discovered that approximately 500,000 VKontakte users have had their accounts silently taken over via Chrome extensions pretending to be VK customization tools in a campaign codenamed VK Styles.

See also: GhostPoster: Malicious extensions infected browsers for years

The malware embedded in these extensions is designed to engage in active account manipulation, automatically enrolling users in the attacker's VK groups, resetting account settings every 30 days to override user preferences, manipulating CSRF tokens to bypass VK's security protections, and maintaining persistent control.