Fake Madgicx Plus and SocialMetrics Extensions Are Hijacking Meta Business Accounts

Cybersecurity researchers have uncovered two concurrent campaigns delivering fake browser extensions via malvertising and counterfeit sites to hijack Meta Business accounts. The malvertising drive promotes fake Meta Verified extensions, notably SocialMetrics Pro, with at least 37 malicious ads observed; the extension is hosted on Box and is designed to harvest session cookies and relay them to a Telegram bot controlled by attackers, while also exposing the victim’s IP address.

A separate operation targets advertisers with rogue Chrome extensions branded as Madgicx Plus and other tools such as Meta Ads SuperTool and Madgicx X Ads, promoted as AI-powered productivity enhancements but capable of injecting scripts, intercepting traffic, and harvesting data to enable account takeover.

The campaigns are described by Bitdefender as using a mass-generated, continuously refreshed malvertising approach and by Cybereason as involving extensions that can access tied Google and Facebook credentials and interact with the Facebook Graph API to retrieve further account information.

The extensions have been cited as fluent in Vietnamese, with the tutorials and code comments apparently reflecting Vietnamese-speaking threat actors, who aim to sell hijacked Facebook Business and Ads accounts on underground forums or reuse them for further malvertising.

For context, the first Madgicx Plus extension listed as a “The SuperApp for Meta Advertisers” was published in February 2025, with other variants appearing in March 2025, and the campaign emphasises broad session hijacking and credential theft capabilities once installed.