108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users

Security researchers disclosed a large-scale malicious Chrome extension campaign (108 extensions, ~20,000 installs) that use a common backend (144.126.135.238) to steal Google account credentials, exfiltrate Telegram Web sessions, inject arbitrary scripts/ads into pages, and strip security headers; extensions impersonate legitimate utilities and games to evade detection and have Russian-language comments in some code. Users are advised to remove the extensions and log out of Telegram Web sessions from mobile apps.