131 Malicious Chrome Extensions Abused WhatsApp Web in a Massive Spam Campaign

In early 2025, researchers uncovered a massive spam campaign that abused WhatsApp Web via 131 malicious Chrome extensions, which were marketed as business coming-together tools but secretly automated bulk messaging. The extensions shared identical backend infrastructure and codebases, with attackers rebranding and publishing clones to bypass Chrome Web Store moderation and rapidly reach users, most of whom were in Brazil.

Investigations traced the majority of uploads to DBX Tecnologia and Grupo OPT, operating under a white‑label reseller model, enabling third parties to rebrand and list the tools as their own Chrome extensions. Once installed, the extensions injected malicious JavaScript into web.whatsapp[.]com to automate bulk messaging, contact scraping, and scheduling, while falsely claiming privacy compliance or CRM integration.

Researchers observed continuous activity from early 2025 through 14 October 2025, suggesting multiple developers maintained active clones and reuploaded extensions after takedowns. The campaign yielded 27 IoCs shared by AlienVault OTX, and according to AlienVault OTX, highlights the growing risk of browser extensions as a supply chain vector.