30
30
30
30
30
30
Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users
Malicious 'Twitch Enhanced Viewer | JeetBot' browser extension stole live OAuth session tokens from roughly 31,000 Chrome and Firefox users.
Socket.dev found the cross-store extension 'Twitch Enhanced Viewer | JeetBot' rerouted Twitch playlist requests through operator-controlled proxies, attaching the victim's account-level OAuth token as a URL parameter where it could be logged in cleartext. About 30,000 Chrome and 552 Firefox installs were exposed, with tokens forwarded for nearly every watched channel to infrastructure tied to a Russian commercial bot service. The stolen bearer token enables chat, whisper, account-setting access and channel-point spending without the password or 2FA.
52
30
30
30
Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker
Unit 42 exposed CL-CRI-1171, a pay-per-install operation using YouTube gaming channels and SEO poisoning to deliver RATs and a Chrome hijacker.
Palo Alto Networks Unit 42 identified over 10,000 OfferLoader samples and 11 YouTube channels pushing trojanized installers via gaming lures and SEO-poisoned searches for tools like WinDirStat and Bluetooth drivers. Trojanized Inno Setup installers spawn three payload branches: Insomnia RAT (dual Node.js/Python backdoor that disables Microsoft Defender), ARKTunnel (undocumented RAT hiding its payload in a bitmap image and tunneling TCP/UDP), and Docro Hijacker (alters Chrome protected preferences to hijack search and affiliate links). The pay-per-install model sells each infection to multiple buyers, reaching gamers as well as corporate and government endpoints.
55
30
30
30
30
30
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.
Socket and researcher Kush Pandya identified 737 Chrome VPN and proxy extensions, published across at least 40 developer accounts with 75,486 installs, that route entire browser sessions through one provider's SOCKS5 proxies on port 1082. Of these, 274 impersonate 66 established brands including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare 1.1.1.1. The proxy bypass list only excludes loopback addresses, exposing visited destinations, source IPs, TLS SNI values, and plain-HTTP request bodies to the operator. 221 extensions have been removed from the Chrome Web Store while 516 remain listed as active.
60
30
30
30
30
30
30
30
30
30
30
30
30
30
30
Malware bypasses browser checks to force install Chrome, Edge extensions
Elastic Security Labs detailed KREMLIN, a Brazilian banking malware that silently installs malicious Chrome and Edge extensions, with 1,515 confirmed infections.
Elastic Security Labs analyzed KREMLIN, a toolkit used by a Brazilian operation in at least seven campaigns since May 2025 that impersonates 12 banks to trick users into opening a JavaScript file disguised as a bank receipt or invoice. After anti-sandbox checks, it downloads Node.js, persists via a scheduled task, and fetches payload locations from an Ethereum smart contract, hiding payloads in JPEG images on Internet Archive. The toolkit bypasses Chromium integrity mechanisms to install unapproved Chrome/Edge extensions masquerading as AVSync that steal cookies, keylog form input, capture screenshots, and intercept HTTP traffic, while recent campaigns deployed the REMCOS RAT and earlier ones Pulsar RAT. Elastic confirmed 1,515 infected systems, almost all in Brazil, and disrupted the campaign by registering an anti-sandbox canary domain; the linked wallet handled roughly 20,800 USDT incoming and 19,000 USDT outgoing.
62
30
30
30
30
30
30
Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum
Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.
Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.
55
30