A recently discovered malicious Chrome extension, posing as Google Translate, has been found to steal sensitive browser data, live-stream web sessions, and allow attackers to remotely control Chrome windows without the user’s knowledge.
The attack initiates with a suspected Rust-based malware loader. Researchers identified that this loader deploys a malicious Chrome extension alongside an AutoIt script, which subsequently installs the Stealcv2 information-stealing malware. This multi-stage infection chain grants attackers both traditional data-stealing capabilities and deep control over the victim’s browser environment.
Once installed, the fraudulent extension can collect a wide range of browser-resident data, including browsing history, saved bookmarks, details of installed extensions, cookies, and stored credentials. Such information enables attackers to hijack online accounts, bypass session-based protections, and profile victims to identify high-value services like email, cryptocurrency platforms, cloud consoles, and corporate applications.
Notably, the extension provides attackers with a real-time view of Chrome windows and the ability to operate websites remotely using mouse clicks and keyboard inputs. This effectively turns the browser into a remotely controlled interface for the threat actor. Chrome’s extension APIs can legitimately interact with tabs and, when granted relevant permissions, may access sensitive tab properties or inject scripts into matching websites—permissions that can be exploited when users install untrusted extensions.
Unlike conventional remote-access malware, this campaign is designed to conceal interactive fraud. The extension reportedly enables remote control of browser windows that are out of focus, meaning attackers can perform actions in the background while the victim works in another application or window. This reduces the chance that a user will notice unauthorized clicks, navigation, or form submissions occurring in Chrome.
Researchers also observed features for setting a proxy and injecting attacker-controlled JavaScript into selected websites. Proxy configuration could help route browser traffic through infrastructure controlled by the attackers, while JavaScript injection can alter the content users see or manipulate sessions on targeted domains. This creates opportunities for account takeover, payment fraud, data theft, and targeted social engineering.
Another major risk is a man-in-the-browser phishing technique. The extension can overlay a legitimate website with an iframe that loads content from an attacker-controlled phishing page. The browser’s address bar may still show the genuine domain, potentially convincing victims that they are interacting with a trusted login portal. Users could then submit passwords, multi-factor authentication codes, or payment details directly to criminals without realizing that the visible form is fraudulent.
The malware’s Google Translate branding is particularly dangerous because translation extensions are common, useful, and rarely viewed as high-risk by users. Threat actors have repeatedly abused trusted-looking browser add-ons to gain access to credentials, cookies, screenshots, and web sessions; a previous campaign linked to the Kimsuky threat actor used a Chrome extension hosted as “GoogleTranslate.crx” to collect account data and browser information.
Users should review installed Chrome extensions immediately, remove unfamiliar or unnecessary add-ons, and scrutinize permission requests—particularly broad access to website data. Organizations should restrict unmanaged extensions, monitor for suspicious browser-policy changes, and require phishing-resistant multi-factor authentication to limit damage from stolen passwords and session data.
This incident underscores the evolving tactics of cybercriminals who exploit trusted platforms and services to distribute malware. It highlights the importance of vigilance when installing browser extensions and the need for robust security measures to detect and prevent such sophisticated attacks.
