Fake TikTok Downloaders on Chrome and Edge Spying on 130,000 Users

LayerX Security uncovered the "StealTok" campaign: over a dozen TikTok downloader browser extensions in Chrome and Edge stores that lured users with watermark-free downloads while performing device fingerprinting and collecting high-entropy browser data (timezone, language, battery status, etc.). The extensions used long dormant benign behavior to build reputation, then activated data-exfiltration and token-capture capabilities, affecting more than 130,000 users with thousands still actively installed; several variants remain available in stores.