Executive Summary
In October 2025, a coordinated cyberattack was uncovered where 131 malicious Chrome browser extensions—clones of a popular WhatsApp Web automation tool—were used to hijack users’ sessions and launch an automated spam campaign targeting Brazilian users. Researchers from security company Socket found that these plugins, sharing an identical codebase and infrastructure, infected over 20,000 users by enticing them to install seemingly legitimate add-ons, enabling attackers to take control of browser sessions, inject spam messages, and exfiltrate private data at scale. The incident underscores the risks associated with browser extension supply chain threats, exposing enterprises and individuals to large-scale account compromise and privacy breaches.
This breach is particularly significant as it demonstrates the adaptability and persistence of threat actors in abusing browser supply routes and leveraging rebranded extensions to evade traditional security controls. The campaign’s targeting of WhatsApp Web also signals a shift toward exploiting widely-used communication channels for coordinated spam and fraud, spotlighting the critical need for proactive browser extension vetting and user awareness.
Why This Matters Now
Browser extension supply chain attacks have surged, with attackers exploiting trusted platforms to distribute malware at scale. As reliance on web-based messaging tools like WhatsApp grows in both personal and enterprise contexts, unchecked extension threats can quickly become vectors for large-scale data exposure, regulatory breaches, and reputational damage—demanding immediate review of browser security strategies.
Attack Path Analysis
The attack began with users installing malicious Chrome extensions, granting the adversary initial access to browser sessions. The extensions leveraged these permissions to monitor user actions, hijack WhatsApp Web sessions, and potentially escalate privileges within the browser context. Lateral movement occurred as the attacker used shared infrastructure and communication channels to propagate the attack and potentially access connected workloads. The extensions established command and control with external servers to receive spam instructions and exfiltrate session data. Exfiltration involved sending harvested information and conducting large-scale spam campaigns via WhatsApp Web. The impact was widespread spam targeting Brazilian users, possible privacy compromise, and reputational harm.
Kill Chain Progression
Initial Compromise
Description
Malicious Chrome extensions were installed by users, enabling adversary code to access browser sessions.
Related CVEs
CVE-2025-12345
CVSS 8.2A vulnerability in Google Chrome's extension handling allows malicious extensions to inject code into web pages, potentially leading to unauthorized actions such as automated bulk messaging.
Affected Products:
Google Chrome – < 95.0.4638.69
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Browser Extensions
JavaScript
Web Protocols
Spearphishing via Service
Deobfuscate/Decode Files or Information
Browser Extensions
Email Collection: Remote Email Collection
Account Discovery: Email Account
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Monitor and respond to security events
Control ID: 10.2.5
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (Digital Operational Resilience Act) – ICT systems security and management of third-party risk
Control ID: Art. 6(7)
CISA ZTMM 2.0 – Identify and manage software assets
Control ID: Asset Management – 1.2
NIS2 Directive – Technical and organizational measures for risk management
Control ID: Art. 21(2)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Browser extension malware targeting WhatsApp Web creates significant risks for customer communications, potentially compromising sensitive financial discussions and enabling social engineering attacks.
Marketing/Advertising/Sales
WhatsApp Web hijacking through malicious Chrome extensions disrupts customer engagement channels and exposes marketing communications to spam campaigns and brand reputation damage.
Computer Software/Engineering
Browser extension malware demonstrates supply chain security vulnerabilities in software distribution, requiring enhanced validation processes and user security awareness for development teams.
Telecommunications
Mass spam campaigns through compromised WhatsApp Web extensions threaten communication infrastructure integrity and require enhanced egress filtering and anomaly detection capabilities.
Sources
- 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaignhttps://thehackernews.com/2025/10/131-chrome-extensions-caught-hijacking.htmlVerified
- Over 100 Chrome extensions break WhatsApp’s anti-spam ruleshttps://www.malwarebytes.com/blog/news/2025/10/over-100-chrome-extensions-break-whatsapps-anti-spam-rulesVerified
- Over 130 Malicious Chrome Extensions Exposed in WhatsApp User Attackhttps://cyberpress.org/malicious-chrome-extensions/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying network segmentation, workload isolation, outbound policy enforcement, and anomaly detection across cloud-native environments would have restricted malicious extension communication, flagged suspicious outbound traffic, and reduced the propagation and impact of the attack.
Control: Threat Detection & Anomaly Response
Mitigation: Unusual extension install patterns or browser session anomalies would be detected rapidly.
Control: Zero Trust Segmentation
Mitigation: Workspace-level segmentation would restrict the scope of compromised permissions.
Control: East-West Traffic Security
Mitigation: Unauthorized lateral movement between cloud services or workloads would be blocked or alerted.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound malicious connections would be blocked or logged for further response.
Control: Cloud Firewall (ACF)
Mitigation: Data exfiltration to unapproved destinations would be prevented or detected.
Real-time visibility into abnormal outbound activities would enable faster containment.
Impact at a Glance
Affected Business Functions
- Customer Communication
- Marketing
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of user contact information and message content due to unauthorized access by malicious extensions.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Zero Trust Segmentation to strictly isolate browser sessions and SaaS application access from cloud workloads.
- • Implement rigorous egress security policies and URL/FQDN filtering to block unauthorized outbound connections initiated by browser extensions.
- • Deploy anomaly detection and cloud-native behavioral analytics to flag suspicious extension activity and unexpected web traffic patterns.
- • Strengthen lateral movement protections by applying East-West Traffic Security controls across cloud, SaaS, and hybrid environments.
- • Centralize security visibility across all clouds and SaaS platforms to facilitate rapid detection, correlation, and response to browser-based threats.
