5 Malicious Chrome Extensions Attacking Enterprise HR and ERP Platforms for Complete Takeover

Five coordinated malicious Chrome extensions (four under databycloud1104 and one as softwareaccess) target Workday, NetSuite, and SuccessFactors to continuously extract session tokens, perform bidirectional cookie injection for immediate account takeover that can bypass MFA, and use DOM manipulation/MutationObserver-based page blocking to prevent administrators from performing remediation; Socket.dev reports these extensions have reached over 2,300 users and employ a multi-extension strategy to maintain persistent, high-impact access.