US Edition108 Malicious Chrome Extensions Found Stealing Data and Injecting Ads Into Every Page You Visit — Delete Them Right Now
Socket said 108 extensions on the Chrome Web Store used shared infrastructure to steal Google tokens, hijack Telegram sessions, and run ad fraud.
5 Articles
5 Articles
The Socket security platform has identified a total of 108 malicious extensions in the Chrome browser that steal data from Google and Telegram victims and allow 'prompt injection' type attacks.
In a blog post published on April 13, 2026, Socket's research teams reveal that, for several months, 108 Chrome extensions apparently anodized have secretly worked for the same operator, exfiling sessions, Google identifiers and navigation data to a centralized infrastructure
108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users
Cybersecurity researchers have discovered a new campaign in which a cluster of 108 Google Chrome extensions has been found to communicate with the same command-and-control (C2) infrastructure with the goal of collecting user data and enabling browser-level abuse by injecting ads and arbitrary JavaScript code into every web page visited. According to Socket, the extensions are published
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
