131 Malicious Chrome Extensions Discovered Targeting WhatsApp Users

A new wave of spamware targeting WhatsApp Web users has emerged, with the Socket Threat Research Team revealing 131 malicious Chrome extensions flooding the Chrome Web Store. The extensions are not traditional malware but high‑risk automation tools that vin the platform policies to fuel large‑scale spam campaigns, primarily affecting Brazilian users.

At the core is a single WhatsApp Web automation tool that has been cloned and rebranded into 131 extensions, all sharing the same codebase, design patterns and backend infrastructure, published through only two developer accounts linked to DBX Tecnologia and its affiliate Grupo OPT. The extensions are branded under WL Extensão and WLExtensao across 83 listings, and the campaign has been running for at least nine months with regular updates through 2025.

In total, these 131 clones account for at least 20,905 active users, with code injected directly into WhatsApp Web pages to automate bulk messaging and bypass anti‑spam controls, according to Socket Threat Research Team.