Malicious Chrome Extensions: From Business Data Theft to AI Abuse

Recent disclosures show how browser extensions—once seen as productivity boosters—are increasingly weaponized to steal sensitive data, hijack accounts, and even exploit AI hype.

Targeting Meta Business Suite

Extension: CL Suite by @CLMasters (ID: jkphinfhmfkckkcnifhjiplhfoiefffl).
Marketed as a tool to scrape Meta Business Suite data and generate 2FA codes.
Reality: Exfiltrates TOTP seeds, one‑time codes, Business Manager contact lists, and analytics data to attacker infrastructure.
Impact: Enables unauthorized access to high‑value business accounts.

VK Styles Campaign

Over 500,000 VKontakte accounts hijacked via extensions masquerading as VK customization tools.
Capabilities: Forced subscriptions, CSRF token manipulation, persistent account resets.
Operator: GitHub user 2vk, maintaining payloads with deliberate version control and iterative improvements.
Scope: Primarily Russian‑speaking users, but also Eastern Europe and diaspora communities.

AI‑Themed Extensions (AiFrame Campaign)

Cluster of 32 add‑ons advertised as AI assistants for summarization, chat, writing, and Gmail.
Installed by 260,000+ users.
Technique: Remote iframe overlays pointing to attacker‑controlled domains, enabling dynamic malicious updates.
Gmail targeting: Extracts visible email content directly from the DOM and exfiltrates it to third‑party servers.

Data Broker Ecosystem

Report: 287 Chrome extensions exfiltrating browsing history to data brokers.
Reach: 37.4 million installs, ~1% of global Chrome userbase.
Data flows to firms like Similarweb and Alexa, monetizing user behavior at scale.

Defensive Recommendations

Minimalist approach: Install only necessary, well‑reviewed extensions.
Audit regularly: Check permissions and remove unused add‑ons.
Separate profiles: Use distinct browser profiles for sensitive tasks.
Allowlisting: Organizations should enforce extension policies to block malicious or non‑compliant tools.

Final Thought

Browser extensions are no longer just utilities—they’re part of the modern attack surface. Whether disguised as business tools, social media customizers, or AI assistants, malicious add‑ons exploit trust to harvest data and hijack accounts. The lesson is clear: treat every extension as code with privileged access, and validate it accordingly.