Fake AI Ad Tool “Madgicx Plus” Hijacks Meta Advertiser Accounts

Cybereason Security Services has uncovered a malicious Chrome extension campaign targeting Meta (Facebook and Instagram) advertisers, branded as “Madgicx Plus,” a fake AI-driven ad optimization tool designed to hijack business sessions, steal credentials and compromise advertiser accounts.

According to Cybereason, the latest version shifts focus to Meta advertisers through a newly crafted lure, promising to boost ad ROI with artificial intelligence but delivering dual-purpose malware capable of credential theft and account takeover. Threat actors set up professionally crafted domains such as madgicx-plus[.]com and madgicxads[.]world to distribute the extensions, with Cybereason noting this appears to be an evolution of the same campaign rather than the work of unrelated copycats.

The campaign uses overreaching permissions, including host_permissions that grant full access to all websites the user visits, enabling the extension to inject content scripts, read DOM data and potentially hijack sessions across any domain. It also abuses Chrome’s Declarative Net Request API to strip HTTP Origin headers, allowing the attackers to impersonate victims by stealing valid session tokens and bypassing login credentials.