108 Chrome Extensions in Google's Official Store Are Stealing OAuth2 Tokens. All of Them Are Still Available to Download.

Socket Security's researchers identified 108 malicious Chrome extensions connected by a single shared backend infrastructure. Despite appearing to come from different developers, all 108 extensions route data to the same C2 at IP address 144.126.135[.]238, using the domain mines[.]cloudapi[.]stream.

The threat actor published the extensions under five distinct publisher identities: Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt. The categories were deliberately chosen to mimic legitimate utility and entertainment extensions: Telegram sidebar assistants, slot machine games, Keno games, YouTube and TikTok enhancers, and text translation tools. These categories attract both casual users and business users looking for productivity shortcuts.

By distributing 108 extensions across five publisher identities and multiple unrelated categories, the threat actor reduces the likelihood of pattern detection by automated review systems. A single malicious publisher with 108 extensions would trigger scrutiny; five publishers with roughly 20 extensions each across gaming, productivity, and messaging categories is far easier to conceal in a store hosting over 130,000 extensions.

Russian-language comments were discovered embedded in the source code of multiple extensions during analysis — a linguistic attribution indicator, though confirmed nation-state involvement has not been established. The shared C2 backend is the definitive fingerprint that ties the campaign together.

The most operationally dangerous component of this campaign is the OAuth2 token theft cluster. Fifty-four of the 108 extensions use Chrome's chrome.identity.getAuthToken API to silently extract authenticated user data without any visible prompt.

When a user installs one of these extensions and clicks the embedded sign-in button, the extension requests a Google OAuth2 Bearer token. The following data is transmitted to mines[.]cloudapi[.]stream/auth_google: the user's Google email address, full name, profile picture URL, Google account identifier, and the OAuth2 Bearer token itself.

An OAuth2 Bearer token is not a password — it is more dangerous than a password in several respects. It provides immediate, authenticated access to Google APIs without a credential prompt. It bypasses multi-factor authentication entirely, since MFA was already completed when the token was issued. And in enterprise environments where Google Workspace is the SSO provider for business applications — Salesforce, Slack, GitHub, Atlassian, and hundreds of others — a valid Google OAuth2 token can be the key to an organisation's entire SaaS application estate.

For organisations that have been tracking the ShinyHunters Salesforce breach covered in our recent dark web intel post, this OAuth2 token attack completes a related picture: the cloud identity infrastructure powering enterprise SaaS is under simultaneous attack across multiple vectors. Browser-level credential theft and cloud misconfiguration exploitation both lead to the same destination — unauthorised access to business-critical systems without triggering an MFA challenge.

A separate cluster of 45 of the 108 extensions carries a different capability: a universal backdoor that activates on browser startup.

When Chrome launches on an endpoint where one of these 45 extensions is installed, the extension contacts the C2 server at 144.126.135[.]238 and receives a URL to open. The extension then navigates the browser to that URL without any user interaction. The attacker controls which URL is served — and can change it at any time without pushing an extension update.

At minimum, this backdoor enables ad fraud: silently loading ad-serving pages in background tabs generates fraudulent impressions without visible activity. At worst, the C2-supplied URL can be a phishing page, a credential-harvesting site, a malicious download, or a page targeting a browser vulnerability. The April 2026 Patch Tuesday advisory identified multiple actively exploited browser vulnerabilities — an extension backdoor capable of targeting those flaws on every Chrome startup creates a compounded risk chain that requires only a single extension installation to initiate.

This persistence mechanism is particularly significant in enterprise environments where browsers are launched at the start of every working day on the same managed endpoint. A backdoor that runs every morning, on every affected endpoint, reaching out to attacker-controlled infrastructure for instructions, represents a durable and reliable attacker foothold that survives most conventional remediation actions short of explicit extension removal.

The most technically precise component of the campaign is the Telegram session hijacking extension, identified by Chrome extension ID obifanppcpchlehkjipahhphbcbjekfa.

Any user who had this extension installed and opened web.telegram.org had their Telegram Web session continuously exfiltrated. The extension extracts the entire contents of Telegram Web's localStorage — containing session tokens, account identifiers, and message-handling state — every 15 seconds, transmitting each snapshot to the attacker's C2 server.

The extension does not stop at exfiltration. It accepts inbound commands from the C2 server that can overwrite the victim's Telegram Web localStorage with attacker-supplied session data, then force a page reload. The practical effect is a silent account swap: the victim's Telegram Web session is replaced with the attacker's, giving the attacker full control of the Telegram account through the victim's browser without any visible indication that the account has been compromised.

For organisations where Telegram is used for operational communications — a common pattern in technology, finance, and media — this extension gives attackers direct access to internal messaging channels, contact lists, and files shared through Telegram Web. The 15-second exfiltration interval ensures that even a brief Telegram Web session is captured before the user closes the tab.

The following IOCs were published by Socket Security on April 14, 2026. Block C2 infrastructure at the network layer and hunt for the publisher identities in your browser extension inventory.

Six immediate actions for security and IT teams:

The 108 malicious Chrome extension campaign shows how browser extension attack surface is being operationalized at scale. The Chrome Web Store is a trusted distribution channel — users install extensions without the scrutiny they would apply to standalone executables. The malicious Chrome extensions OAuth2 token theft campaign exploits that trust systematically, using five publisher identities, 108 extensions, and a shared C2 to extract Google credentials across 20,000 installs.

The 20,000 users already affected have had their Google account identity exfiltrated. If your organisation has employees who installed extensions from Yana Project, GameGen, SideGames, Rodeo Games, or InterAlt, assume those Google identities are in attacker hands. Revoke tokens. Remove extensions. Block C2 infrastructure. Then build the extension governance process that would have stopped this before the first install.