Chrome Extensions Infected 500K Users to Hijack VKontakte Accounts

A widespread malware campaign delivered via five malicious Chrome extensions (notably “VK Styles”) infected roughly 500,000 VKontakte users by using a two-stage delivery model: extensions fetched encoded payload URLs from attacker-controlled VK profiles and downloaded additional code from a GitHub repository to hijack accounts, manipulate CSRF tokens, auto-subscribe victims to attacker groups, and maintain persistence from June 2025 through January 2026.