108 malicious Chrome extensions harvest Google identities and steal Telegram Web sessions
Socket found 108 malicious Chrome extensions with about 20,000 installs. Some collected Google profile details; Telegram Multi-account stole Telegram Web sessions. Remove listed extensions and revoke affected Telegram sessions. Full removal remains unconfirmed.
Open Chrome’s menu > Extensions > Manage extensions, compare your extensions with the names and IDs in Socket’s report, and remove any matches. If you used Telegram Multi-account with Telegram Web, open Telegram on your phone and choose Settings > Devices > Terminate all other sessions. If you signed into a listed extension with Google, review your Google Account’s third-party connections and revoke unfamiliar access.
- Telegram Multi-accountno fixed version yet
- Web Client for Telegram - Telesideno fixed version yet
What’s happening
Socket disclosed a coordinated campaign of 108 malicious Chrome extensions on 13 April, with approximately 20,000 installs. They posed as games, Telegram clients, translation tools, browser utilities and YouTube or TikTok helpers. Fifty-four collected Google profile information after sign-in, while 45 could open attacker-selected pages when the browser started. Telegram Multi-account repeatedly stole active Telegram Web sessions, putting messages and contacts at risk. BleepingComputer reported Google OAuth token theft, but Socket explicitly states that those tokens stayed in the browser: names, email addresses, profile pictures and stable Google account identifiers were transmitted, without granting Google account access. Socket requested takedowns. Clubic reported some disabling on 15 April but found other extensions still available. As at 3 November, no Google campaign statement or later confirmation of complete removal was found in the reviewed sources. Remediation is extension removal and session revocation; no clean replacement releases were identified.
- What
- Poisoned software
- Affects
- 108 malicious Chrome Web Store extensions, including Telegram Multi-account and Web Client for Telegram – Teleside
- Affected
- 108 Chrome extensions identified in Socket’s report, published under Yana Project, GameGen, SideGames, Rodeo Games and InterAlt; a complete affected-version range was not published.
Telegram Multi-account (extension ID obifanppcpchlehkjipahhphbcbjekfa): active Telegram Web session theft.
Web Client for Telegram – Teleside (extension ID mdcfennpfgkngnibjbpnpaafcjnhcjno), version 3.8.0: malicious campaign member with staged Telegram-theft infrastructure; active session-theft code was absent from the analysed version. - Fixed in
- Nothing to patch
- Since
- 13 Apr 2026
- Closed
- 15 Apr 2026
Timeline
- Update
Clubic reported that Google had disabled some extensions, but independently found others still available. It did not provide a complete removal count.
- Update
BleepingComputer independently found many listed extensions still available in the Chrome Web Store. Google had not answered its request for comment when the report was published.
- Made publicNothing to patch
Socket disclosed 108 malicious Chrome extensions with approximately 20,000 installs and shared attacker infrastructure. It requested takedowns from Google; the extensions were still available when its research was published.
Sources
- 108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 InfrastructureSocket · 13 Apr 2026
- Install and manage extensionsGoogle
- Telegram FAQ: My phone was stolen, what do I do?Telegram
- Over 100 Chrome Web Store extensions steal user accounts, dataBleepingComputer · 14 Apr 2026
- 100 Chrome Extensions Steal User Data, Create BackdoorSecurityWeek · 15 Apr 2026
- Ces 108 extensions Chrome volaient des données de comptes Google et des sessions TelegramClubic · 15 Apr 2026