Five Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts

Cybersecurity researchers have uncovered five new malicious Chrome extensions that pose as HR and ERP tools such as Workday, NetSuite, and SuccessFactors to hijack user accounts.

The extensions—DataByCloud Access (ID: oldhjammhkghhahhhdcifmmlefibciph, Published by: databycloud1104) with 251 installs; Tool Access 11 (ID: ijapakghdgckgblfgjobhcfglebbkebf, Published by: databycloud1104) with 101 installs; DataByCloud 1 (ID: mbjjeombjeklkbndcjgmfcdhfbjngcam, Published by: databycloud1104) with 1,000 installs; DataByCloud 2 (ID:

makdmacamkifdldldlelollkkjnoiedg, Published by: databycloud1104) with 1,000 installs; and Software Access (ID: bmodapcihjhklpogdpblefpepjolaoij, Published by: Software Access) with 27 installs—have been removed from the Chrome Web Store, though they remain available on third‑party sites such as Softonic.

A coordnated campaign exfiltrates cookies to a remote server, blocks security administration pages via DOM manipulation, and enables session hijacking through cookie injection, according to Socket security researcher Kush Pandya. DataByCloud Access requests permissions for cookies and other capabilities across Workday, NetSuite, and SuccessFactors domains, and transmits authentication cookies to api.databycloud[.]com every 60 seconds.

DataByCloud 1 and DataByCloud 2 extend blocking to 56 pages and include features like password changes and 2FA device management, while Software Access combines cookie theft with cookie injection to hijack sessions and protect credential inputs. Two of the extensions—DataByCloud 1 and DataByCloud 2—first appeared on 18 August 2021, and the campaign is seen as a coordinated operation using identical functionality and infrastructure patterns. Chrome users are urged to remove the add‑ons, reset passwords, and review for signs of unauthorised access.