Fake Productivity Tools: 5 Malicious Chrome Extensions Hijack Enterprise Sessions

Socket’s Threat Research Team uncovered a coordinated campaign of five malicious Chrome extensions (DataByCloud Access, Data By Cloud 1, Data By Cloud 2, Tool Access 11, and Software Access) aimed at enterprise users; the extensions exfiltrate session cookies every 60 seconds, inject stolen cookies to bypass MFA, and actively block access to administrative security pages to prevent remediation, with evidence pointing to a single threat actor and over 2,300 users impacted.