Chrome Extension Scam Exposed: Hackers Stealing Meta Accounts

A campaign aimed at Meta advertisers using fake AI-powered ad optimisation tools has been uncovered, with cybercriminals distributing malicious Chrome extensions designed to harvest credentials and hijack business accounts. According to Cybereason Security Services, the operation revolves around a deceptive platform called “Madgicx Plus,” and relies on impersonation websites promoting legitimate-looking extensions to promising productivity gains.

The investigation found a large network of more than 20 domains, including privacy-shield[.]world, madgicxads[.]world, and madgicx-plus[.]com, hosted via infrastructure linked to IP address 185.245.104[.]195 and operated by VDSina, suggesting coordinated activity rather than isolated incidents.

Analysis of the extensions revealed dangerous host_permissions and declarativeNetRequest capabilities, enabling broad data access and potential network traffic manipulation, while techniques to strip the Origin header from requests facilitate unauthorized API access using victims’ session tokens.

Researchers note persistent command-and-control communication with madgicx-plus[.]com, enabling real-time data exfiltration, and describe the campaign’s evolution as a sign of a larger, adaptive threat to advertiser accounts.