Most small business owners don't think twice about browser extensions — a tool to manage tabs, a sidebar for a messaging app, a game to kill five minutes. Researchers just proved they shouldn't be so relaxed.
In mid-April 2026 (Socket's threat-research team published the analysis on April 13; coverage followed on the 14th), Socket revealed that 108 malicious Google Chrome extensions were operating as a coordinated data-theft campaign, all reporting to the same command-and-control server. Collectively they amassed around 20,000 installs in the Chrome Web Store before being identified. Chrome holds well over 60% of the global browser market, making it the dominant attack surface for any threat actor targeting everyday users.
They disguised themselves as Telegram sidebar clients, YouTube and TikTok enhancers, slot-machine games, and translation tools — published under five fake publisher identities (Yana Project, GameGen, SideGames, Rodeo Games, InterAlt) to avoid detection. All 108 routed stolen credentials, identities, and browsing data to the same operator. The breakdown:
Source-code analysis showed Russian-language comments across several extensions, though formal attribution hasn't been confirmed.
Large enterprises have endpoint management, browser policies, and security teams watching for anomalies. Most SMBs have none of that. Employees install extensions freely — often on the same machines used for company email, cloud storage, accounting, and banking. A single compromised extension can silently harvest session tokens that give an attacker access to all of those systems without ever needing a password. Per the 2025 Verizon DBIR, credential abuse remains a leading initial-access method against small businesses, and browser-based harvesting is one of the cleanest ways to achieve it — no phishing email, no obvious red flag. The Chrome Web Store has improved vetting, but this campaign proves determined actors can still publish, accumulate thousands of installs, and operate for an extended period before detection.
chrome://extensions — if you don't recognize or actively use it, remove it.myaccount.google.com/security for unfamiliar sign-ins or connected apps.108 extensions. 20,000 installs. One shared server silently collecting credentials and hijacking sessions across every page your employees visited. The browser is the new perimeter — attackers know that, and most SMBs are still acting like it isn't.
Would your current setup catch something like this? Browser security is built into our layered endpoint protection — extension behavior, session access, and suspicious calls from inside the browser.