Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Malicious Chrome extensions hijack Workday, NetSuite, and SuccessFactors sessions

Malware Activity
First reported
Last updated
Happening score
H score 20
2 unique sources, 2 articles

Summary

Hide ▲

Five malicious Google Chrome extensions are impersonating Workday, NetSuite, and SuccessFactors to steal credentials and hijack victim sessions, creating immediate account takeover risk. The extensions steal authentication tokens, block security and incident-response pages, and can inject stolen cookies to take control of accounts. Most of the add-ons were removed from the Chrome Web Store, but some remain available on third-party download sites. Two of the extensions were first published in August 2021, showing the operation has persisted over time.

Related Happenings

ModHeader browser extension hidden browsing-history collector

Malware Activity
H score42 First: 13.07.2026 20:17 Last: 13.07.2026 20:17 Sources 1

About this happening: The ModHeader browser extension shipped a hidden browsing-history collector in its official store version, exposing about 1.6 million installs to covert domain and...

Open Happening

Search for perplexity ai malicious Chrome extension

Malware Activity
H score29 First: 29.06.2026 21:40 Last: 29.06.2026 21:40 Sources 1

About this happening: A malicious Chrome extension named Search for perplexity ai impersonated Perplexity AI while intercepting search traffic and collecting browsing information th...

Open Happening

StegoAd malicious Edge extension operation

Malware Activity
H score19 First: 29.06.2026 11:32 Last: 29.06.2026 11:32 Sources 1

About this happening: The StegoAd operation was removed from the Edge Add-ons store after hiding payloads in images and fonts, stealing credentials, and driving ad fraud across installs tha...

Open Happening

Dormant remote-controlled JavaScript injection path in Adblock for YouTube Chrome extension

Technical Analysis
H score23 First: 25.06.2026 17:12 Last: 25.06.2026 17:12 Sources 1

About this happening: A Chrome extension with 10 million+ installs was found to carry a dormant script-injection path, raising the risk of arbitrary JavaScript execution across visited...

Open Happening

Chrome extension PUP distribution network with fake organic traffic

Malware Activity
H score18 First: 15.06.2026 14:07 Last: 15.06.2026 14:07 Sources 1

About this happening: A network of 152 Google Chrome extensions is distributing a potentially unwanted program (PUP) family through new-tab live-wallpaper add-ons, creating a broad browser-base...

Open Happening

Timeline

  1. 16.01.2026 16:09 1 articles · 6mo ago

    Malicious DataByCloud 1 and DataByCloud 2 first published

    Campaign Scope Update

    Malicious Google Chrome extensions DataByCloud 1 and DataByCloud 2 were first published on August 18, 2021 as part of an extension set that impersonates Workday, NetSuite, and SuccessFactors tools to harvest authentication data and support account takeover.

    Show sources
    Open in new tab
  2. 16.01.2026 16:09 2 articles · 6mo ago

    Researchers disclose five malicious Chrome extensions impersonating Workday and NetSuite

    Initial Disclosure

    Researchers identified five malicious Google Chrome extensions masquerading as Workday, NetSuite, and SuccessFactors tools to steal authentication cookies and tokens, block security administration pages, and enable session hijacking for complete account takeover; most were removed from the Chrome Web Store, while some remained on third-party download sites such as Softonic.

    Show sources
    Open in new tab