Fake Productivity Tools: 5 Malicious Chrome Extensions Hijack Enterprise Sessions

According to Socket’s Threat Research Team, five malicious Google Chrome extensions masquerading as productivity tools for Workday, NetSuite and SAP SuccessFactors have been found to steal authentication tokens and hijack enterprise sessions. The extensions—DataByCloud Access, Data By Cloud 1, Data By Cloud 2, Tool Access 11 and Software Access—have collectively reached over 2,300 users and are designed to infiltrate corporate networks while evading normal security responses.

The campaign employs a triad of techniques, including cookie exfiltration where DataByCloud Access extracts cookies named _session and sends them to a command-and-control server every 60 seconds. In addition, the Software Access extension performs bidirectional cookie injection to retrieve stolen credentials from the attacker’s server and inject them into the victim’s browser, enabling the attacker to bypass multi-factor authentication.

Some extensions also block incident response by wiping content on critical administrative pages and redirecting administrators, effectively locking defenders out of control panels. The pieces share identical code structures and API endpoints, pointing to a single threat actor behind the operation.