{"id":45382,"date":"2026-04-14T16:36:36","date_gmt":"2026-04-14T08:36:36","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/14\/108-malicious-chrome-extensions-steal-google-and-telegram-data-affecting-20000-users\/"},"modified":"2026-04-14T16:36:36","modified_gmt":"2026-04-14T08:36:36","slug":"108-malicious-chrome-extensions-steal-google-and-telegram-data-affecting-20000-users","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/14\/108-malicious-chrome-extensions-steal-google-and-telegram-data-affecting-20000-users\/","title":{"rendered":"108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users"},"content":{"rendered":"
\"108<\/a><\/div>\n

Cybersecurity researchers have discovered a new campaign in which a cluster of 108 Google Chrome extensions has been found to communicate with the same command-and-control (C2) infrastructure with the goal of collecting user data and enabling browser-level abuse by injecting ads and arbitrary JavaScript code into every web page visited.<\/p>\n

According to Socket, the extensions are published under five distinct publisher identities – Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt – and have collectively amassed about 20,000 installs in the Chrome Web Store.<\/p>\n

“All 108 route stolen credentials, user identities, and browsing data to servers controlled by the same operator,” security researcher Kush Pandya said<\/a> in an analysis. <\/p>\n

Of these, 54 add-ons steal Google account identity via OAuth2, 45 extensions contain a universal backdoor that opens arbitrary URLs as soon as the browser is started, and the remaining ones engage in a variety of malicious behaviors –<\/p>\n