Over 100 Chrome extensions in Web Store target users accounts and data

Researchers uncovered a coordinated campaign of more than 100 malicious Chrome extensions in the official Web Store that steal Google OAuth2 bearer tokens and account data, act as persistent backdoors fetching commands from a central C2 (hosted on a Contabo VPS), exfiltrate Telegram Web sessions enabling account takeover, and perform ad injection and proxying; evidence suggests a Russian MaaS operation and many extensions were still available at the time of reporting.