Overview
- Socket disclosed the campaign Wednesday, identifying 108 Chrome extensions tied to a single command server.
- Several add-ons read active Telegram Web sessions and transmit them every 15 seconds, which lets attackers enter accounts without passwords or two-factor codes.
- Socket says others harvest Google profile details and OAuth2 bearer tokens, which are keys that let apps act as you.
- Many extensions include a hidden backdoor that runs at browser start and can open any page for ads, phishing, or code injection.
- Many entries remained in the Chrome Web Store at publication, and researchers advise users to uninstall the add-ons and sign out of all Telegram sessions.