Malicious Chrome Extensions Target Workday and NetSuite Users in Coordinated Attack
In January 2026, cybersecurity researchers uncovered a campaign involving five malicious Google Chrome extensions that impersonated enterprise platforms such as Workday, NetSuite, and SuccessFactors. These extensions worked in unison to steal authentication tokens, disrupt incident response procedures, and seize control of victim user accounts. Attackers leveraged the trust users place in HR and ERP browser tools, exploiting their position to achieve data exfiltration and persistent account takeover across corporate environments. The attack’s main impact included unauthorized access to sensitive business systems and increased potential for widespread lateral movement within organizations. This incident underscores the growing sophistication of browser-based threats as attackers increasingly mimic legitimate business tools to infiltrate organizations. With a rise in social engineering and token theft techniques targeting identity and SaaS workflows, enterprises face heightened risk to cloud and hybrid environments, necessitating additional focus on endpoint, browser, and application-layer defenses.
Kill Chain
