Over 100 Chrome extensions break WhatsApp’s anti-spam rules

According to Socket’s Threat Research Team, a coordinated campaign has flooded the Chrome Web Store with 131 spamware extensions that hijack WhatsApp Web to automate bulk messages and bypass anti-spam controls. The extensions inject code directly into the WhatsApp Web site, running alongside its scripts to enable large-scale outreach and scheduling. All 131 extensions share the same codebase, design patterns and infrastructure, suggesting a coordinated operation.

The researchers reported the extensions to the Chrome security team and requested suspensions of the associated publisher accounts for policy-violating spamware. The article, published on 22 October 2025, also notes that Chrome’s review is a policy compliance check rather than a full audit, and it advises users to check extension permissions and prefer from reputable developers.