Massive Chrome Extension Scam Exposes 20,000 Users to Data Theft

Socket researchers uncovered a large-scale campaign of 108 malicious Chrome extensions in the Chrome Web Store that collectively tricked about 20,000 users into installing seemingly useful tools which then exfiltrated Google and Telegram credentials, injected ads and scripts, routed translations through an attacker C2, and provided universal backdoor capabilities; the extensions were split across five publisher accounts, abused OAuth flows, and remain live while researchers have reported them to Google.