TikTok’s Secret Tracker: The “Featured” Extensions Harvesting Your Data

**Executive summary:** LayerX uncovered a coordinated campaign of at least 12 malicious Chrome/Edge browser extensions posing as TikTok downloaders that have compromised over 130,000 users; the extensions share a single resilient code family, use dynamic remote configuration to change behavior post-installation, collect extensive telemetry (including usage patterns, device characteristics, and battery status) to fingerprint users, and are rapidly redeployed after takedown, enabling persistent data-harvesting and potential future escalation into broader exfiltration or proxy/botnet abuse.