Chrome Extensions Infect 500K Users to Hijack VKontakte Accounts

A coordinated Chrome extension malware campaign disguised as VK customization tools infected ~502,000 users, converting compromised VK accounts into attacker-controlled distribution and C2 infrastructure by embedding configuration in VK profile meta tags and hosting payloads on GitHub Pages; functionality included auto-subscribing accounts to attacker groups, enforcing 30-day setting resets, manipulating VK CSRF cookies, and monetizing via VK Donut, with multiple extension IDs and commit histories provided as indicators.