Behind the Mask of Madgicx Plus: A Chrome Extension Campaign Targeting Meta Advertisers

Cybereason Security Services analyzed an active campaign distributing malicious Chrome extensions branded as “Madgicx Plus” and similar ad-optimization tools to target Meta advertisers. The extensions request wide host permissions, inject scripts, remove Origin headers to bypass security checks, and exfiltrate Google/Facebook session tokens to enable account takeover; investigators uncovered numerous lure domains, shared hosting (behind Cloudflare and VDSina), observed C2 communication, and provided mitigation recommendations to verify publishers, remove unused extensions, and separate browsing contexts.