Massive Fake Chrome Extension Campaign Steals Sensitive Corporate Data

Security researchers identified a massive, coordinated campaign using fake Google Chrome extensions to steal sensitive corporate data from companies worldwide, notable for its scale and technical sophistication. Over 35 malicious extensions were identified, some with over 100,000 installations, affecting companies in more than 40 countries. Extensions disguised as productivity tools steal credentials via form interception, perform session hijacking, exfiltrate emails, and bypass 2FA by capturing TOTP codes in real time. Corporate protection: implement extension whitelist policies via Google Admin Console, block unapproved extension installation, audit installed extensions, deploy Browser Security solutions, and train employees.