MASS ACCOUNT TAKEOVER: 500,000+ VKONTAKTE USERS COMPROMISED VIA MALICIOUS CHROME EXTENSIONS

Threat Summary

Category: Browser Extension Malware Campaign
Features: Session hijacking, forced group subscription amplification, credential abuse, silent auto-update injection, account manipulation persistence
Delivery Method: Trojanized Chrome extensions disguised as VK customization tools
Threat Actor: Alias “2vk” — infrastructure-linked social media abuse operator

---

A large-scale browser extension malware campaign compromised more than 500,000 VKontakte (VK) user accounts through malicious Google Chrome extensions disguised as theme customization and user experience enhancement tools. The campaign targeted VK, Russia’s largest social media platform, by exploiting the high trust users place in browser add-ons that integrate directly into authenticated sessions.

Five Chrome extensions, marketed as tools to modify themes and improve VK functionality, were collectively installed over half a million times. Once deployed, the extensions gained deep access to user browser sessions, allowing attackers to manipulate account settings, force subscriptions to attacker-controlled groups, and override security preferences without user consent.

The malware leveraged Chrome’s automatic extension update mechanism. This allowed the threat actor to push updated malicious payloads silently and continuously without requiring additional user interaction. The persistence mechanism ensured that even if partial functionality was removed or detected, new capabilities could be reintroduced remotely.

Infected accounts were automatically subscribed to attacker-operated VK groups, significantly inflating follower counts and expanding distribution channels for additional malicious content. Each time an infected user accessed VK, the extension executed background scripts that reinforced the subscription cycle, reset altered account configurations every 30 days, and reasserted control over modified settings.

---

Infrastructure at Risk

Browser extensions operate with elevated privileges inside authenticated browser sessions. This grants them access to cookies, session tokens, DOM manipulation capabilities, and background API calls. In the context of VK, the malicious extensions leveraged this access to issue authorized actions on behalf of users without triggering typical login alerts.

The campaign demonstrated several risk vectors:

• Automated forced subscription to attacker groups, creating artificial network amplification
• Resetting of personal account settings to maintain persistent attacker control
• Abuse of session-level authentication to bypass secondary verification layers
• Silent telemetry collection from compromised accounts
• Potential harvesting of personal messages and stored credentials

The malware also monitored in-app purchases. When victims paid for premium themes or features, the extension recorded the transaction, unlocked promised cosmetic functionality, and continued operating malicious routines in parallel. This dual-layer deception reduced suspicion by delivering expected features while sustaining covert abuse.

Because extensions are embedded within the browser runtime environment, traditional endpoint security tools may not flag malicious behavior unless explicit signatures are identified. This architectural trust model makes browser extension ecosystems particularly attractive for session hijacking campaigns.

---

Threat Actor Profile

Researchers traced the campaign to a single operator using the GitHub alias “2vk.” The actor reportedly leveraged VK itself as part of command-and-control infrastructure. By routing operational signaling through legitimate social network channels, the campaign reduced external traffic anomalies and complicated detection efforts.

Using the target platform as infrastructure increases stealth. Security monitoring systems are less likely to block internal social media traffic, enabling malicious scripts to retrieve updates, configuration files, or operational triggers from within the same ecosystem.

The forced subscription mechanism functioned as a growth engine. As infected accounts automatically joined attacker-controlled groups, visibility expanded exponentially. The attacker’s groups accumulated millions of followers, driven largely by automated enrollment rather than organic engagement.

---

Campaign Timeline and Geographic Scope

The operation appears to have been active since mid-2025 and persisted through January 2026. Removal actions began in early February after one major extension, VK Styles, was flagged and taken down from the Chrome Web Store.

Targeting patterns suggest a primary focus on Russian-speaking populations, including users in Eastern Europe, Central Asia, and diaspora communities. The language localization of the extensions reinforced credibility within these user bases.

The scale of infection indicates either limited detection thresholds within extension review processes or successful evasion techniques that allowed the malware to pass compliance checks during submission and updates.

---

Technical Mechanics

The extensions performed several coordinated actions:

• Injected JavaScript into VK pages to manipulate account settings
• Executed automated subscription API calls using active session tokens
• Scheduled periodic resets to reapply attacker-defined configurations
• Leveraged Chrome’s update system to deploy new malicious payloads
• Logged premium feature payments to maintain façade functionality

Because Chrome extensions can declare broad permissions at install time, many users accept deep data access without understanding the operational implications. Once granted, extensions can read and modify website content across domains specified in their manifest files.

The automatic update feature, designed for security patching and feature improvements, becomes a distribution channel for malicious code when exploited. Users rarely review extension version changes unless visible functionality breaks.

---

Parallel Extension Threat Trends

Malicious Chrome extensions have become a recurring attack vector. Previous campaigns involved dozens of extensions embedded with data-stealing code, many marketed as AI productivity tools or VPN services. These extensions collectively affected millions of users and demonstrated similar abuse patterns, including session hijacking, credential harvesting, and background script injection.

Browser-based malware provides a high return on investment for attackers. It avoids traditional executable downloads, integrates into trusted environments, and scales rapidly through marketplace distribution.

---

Forecast — 30 Days

• Continued discovery of malicious extensions embedded within social media enhancement tools
• Increased scrutiny of Chrome Web Store review processes
• Replication of forced subscription amplification tactics on other social platforms
• Growth in session-token abuse targeting authenticated browser environments
• Expanded actor migration to alternative extension marketplaces

---

TRJ Verdict

This campaign underscores a structural vulnerability in browser extension ecosystems. Trust is delegated at installation. Control is retained indefinitely. Updates occur without friction. In that environment, session hijacking becomes a silent and scalable weapon.

Social platforms built around persistent authentication are uniquely exposed. When an attacker controls the browser layer, they control the user’s digital identity within that session. No password breach is required. No phishing email is necessary. The compromise operates inside legitimate traffic flows.

Half a million hijacked accounts represent more than a metric. They reflect the power of supply-chain style distribution through browser marketplaces. The operational model is efficient: disguise functionality, deliver cosmetic value, inject persistence, amplify through forced subscriptions, and update at will.

Cybersecurity posture must expand beyond endpoint detection and password hygiene. The browser is now an attack surface. Extensions are executable code with privileged access. Governance, review enforcement, and runtime monitoring must evolve accordingly.

The digital perimeter no longer ends at the firewall. It begins at the browser.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---