News

Security analysts have identified a Google Chrome extension that secretly collects information from Meta Business Suite and Facebook Business Manager accounts. The add-on, released under the name CL Suite by the handle @CLMasters and listed in the Chrome Web Store with the ID jkphinfhmfkckkcnifhjiplhfoiefffl, claims to help with scraping Meta Business Suite, suppressing verification pop-ups, and producing two-factor authentication codes. It was uploaded to the store on March 1, 2025, and had around 33 installs at the time of reporting.

Despite its advertised features, the extension clandestinely sends TOTP seeds and one-time authentication codes for Facebook and Meta Business accounts, exports Business Manager contact lists and analytics data, and relays that information to infrastructure controlled by the attacker, according to researchers at Socket. The data is reported to be forwarded to a backend at getauth.pro, and the actor can optionally mirror the same payloads into a Telegram channel they control.

Security researcher Kirill Boychenko observed that the extension requests broad permissions for meta.com and facebook.com and, although its privacy statement promises that 2FA secrets and Business Manager data remain on the user’s device, the actual code exfiltrates TOTP seeds and current codes, CSV exports from the Business Manager “People” view, and analytics information to the remote backend.

Operationally, the malicious add-on is capable of capturing the TOTP seed - the alphanumeric secret used to derive time-based one-time passwords - along with the active 2FA code. It navigates to facebook.com and meta.com to access the Business Manager “People” screen and constructs CSV files containing names, email addresses, roles, permissions, and status/access details. The extension also enumerates entities at the Business Manager level and compiles CSVs listing Business Manager IDs and names, attached ad accounts, linked pages and assets, and billing/payment configuration data.

While CL Suite itself does not directly harvest passwords, attackers could pair the stolen 2FA codes with credentials obtained previously through other mechanisms - for example, infostealer logs or leaked credential databases - to take over victims’ accounts. Socket warned that even with a modest install base, the extension supplies enough intelligence to single out high-value targets and enable follow-on intrusions.

Boychenko pointed out that CL Suite repackages aggressive scraping and credential capture as productivity features for Meta Business Suite and Facebook Business Manager. Its ability to extract contact lists, access metadata, and sensitive 2FA material from authenticated pages makes the add-on a purpose-built data collection tool rather than a neutral utility.

In a separate disclosure, Koi Security reported a large-scale campaign that has silently taken over roughly 500,000 VKontakte (VK) accounts via Chrome extensions posing as VK customization tools. This operation, dubbed VK Styles, relies on extensions that contain malware designed to actively manipulate accounts: automatically subscribing victims to attacker-controlled VK groups, reverting user settings every 30 days to overwrite preferences, abusing Cross-Site Request Forgery (CSRF) token handling to bypass VK protections, and maintaining persistent access.

Investigators attribute the campaign to an operator using the GitHub handle 2vk, who leverages VK’s own network to distribute malicious payloads and artificially grow follower counts through forced subscriptions. The extensions observed in this campaign include VK Styles – Themes for vk.com (ID: ceibjdigmfbbgcpkkdpmjokkokklodmc), VK Music – audio saver (ID: mflibpdjoodmoppignjhciadahapkoch), Music Downloader – VKsaver (ID: lgakkahjfibfgmacigibnhcgepajgfdb), vksaver – music saver vk (ID: bndkfmmbidllaiccmpnbdonijmicaafn), and VKfeed – Download Music and Video from VK (ID: pcdgkgbadeggbnodegejccjffnoakcoh).

One notable evasion technique in this campaign is using the HTML metadata tags of a VK profile page (for example, vk.com/m0nda) as a dead-drop resolver to hide the URLs of next-stage payloads. The second-stage component is hosted in a public repository titled “-” associated with the 2vk account; it contains obfuscated JavaScript that gets injected into every VK page a compromised user visits.

The repository remains publicly reachable as of this writing, and a file named “C” accrued 17 commits between June 2025 and January 2026 as the operator iterated on functionality. Security researcher Ariel Cohen noted the steady commit history indicates a maintained project with version control, testing, and gradual improvements rather than ad-hoc or sloppy malware development.

VK Styles has primarily impacted Russian-language users - VK’s core audience - and expanded into Eastern Europe, Central Asia, and Russian diaspora communities worldwide. The campaign appears to have been active since at least June 22, 2025, when the initial payload version was first uploaded to the “-” repository.

Concurrently, researchers uncovered another organized network of 32 Chrome add-ons marketed as AI helpers for tasks like summarization, chat, writing, and Gmail assistance. This cluster, labeled AiFrame, has collectively been installed on more than 260,000 browsers. LayerX researcher Natalie Zargarov explained that while the extensions look legitimate, they embed remote, server-controlled interfaces inside extension-controlled surfaces. In effect, the add-ons serve as privileged proxies that hand sensitive browser capabilities to remote infrastructure rather than executing core features locally.

The AiFrame family includes numerous extensions such as AI Assistant (ID: nlhpidbjmmffhoogcennoiopekbiglbp), Llama (ID: gcfianbpjcfkafpiadmheejkokcmdkjl), Gemini AI Sidebar (ID: fppbiomdkfbhgjjdmojlogeceejinadg), AI Sidebar (ID: djhjckkfgancelbmgcamjimgphaphjdl), ChatGPT Sidebar (ID: llojfncgbabajmdglnkbhmiebiinohek), Grok (ID: cgmmcoandmabammnhfnjcakdeejbfimn), Chat With Gemini (ID: ebmmjmakencgmgoijdfnbailknaaiffh), XAI (ID: baonbjckakcpgliaafcodddkoednpjgf), and many others that advertise AI-driven features and Gmail helpers.

After installation, these extensions load a full-screen iframe that points to a remote domain - for example, claude.tapnetic.pro - enabling the attacker to push new behavior and capabilities without issuing updates via the Chrome Web Store. The iframe can instruct the extension to scan the active browser tab and run a content script that extracts readable article text using Mozilla’s Readability library. Some variants can activate the browser’s speech recognition API and send the transcribed speech back to the remote page. A subset of the add-ons includes logic specifically targeting Gmail to read visible email content from the page DOM whenever a user is on mail.google.com.

LayerX warns that when features tied to Gmail - such as AI-generated replies or summaries - are used, the captured email contents are fed into the extension’s processing pipeline and forwarded to third-party backend servers controlled by the operator. That means message text and related contextual information may be sent off-device and outside Gmail’s security perimeter.

These discoveries are part of a broader trend of browser extension abuse. A recent report from Q Continuum documented 287 Chrome extensions that siphon users’ browsing history and sell it to data brokers; collectively those extensions have been installed roughly 37.4 million times, about 1% of Chrome’s global user base. Previous research has shown similar extension-based data collection feeding intelligence firms and traffic analysts such as Similarweb and Alexa.

To reduce exposure, experts advise adopting a conservative approach: only install extensions that are necessary, have strong reviews, and come from reputable developers. Regularly review and remove any extensions that request excessive permissions or exhibit suspicious behavior. Organizations and privacy-conscious users should consider segregating sensitive activities into separate browser profiles and enforcing an extension allowlist to block unapproved or potentially harmful add-ons.