Cybersecurity researchers have discovered five new malicious Google Chrome web browser extensions that masquerade as human resources (HR) and enterprise resource planning (ERP) platforms like Workday, NetSuite, and SuccessFactors to take control of victim accounts.
“The extensions work in concert to steal authentication tokens, block incident response capabilities, and enable complete account takeover through session hijacking,” Socket security researcher Kush Pandya said in a Thursday report.
The names of the extensions are listed below –
- DataByCloud Access (ID: oldhjammhkghhahhhdcifmmlefibciph, Published by: databycloud1104) – 251 Installs
- Tool Access 11 (ID: ijapakghdgckgblfgjobhcfglebbkebf, Published by: databycloud1104) – 101 Installs
- DataByCloud 1 (ID: mbjjeombjeklkbndcjgmfcdhfbjngcam, Published by: databycloud1104) – 1,000 Installs
- DataByCloud 2 (ID: makdmacamkifdldldlelollkkjnoiedg, Published by: databycloud1104) – 1,000 Installs
- Software Access (ID: bmodapcihjhklpogdpblefpepjolaoij, Published by: Software Access) – 27 Installs
All of them, with the exception of Software Access, have been removed from the Chrome Web Store as of writing. That said, they are still available on third-party software download sites such as Softonic. The add-ons are advertised as productivity tools that offer access to premium tools for different platforms, including Workday, NetSuite, and other platforms. Two of the extensions, DataByCloud 1 and DataByCloud 2, were first published on August 18, 2021.
The campaign, despite using two different publishers, is assessed to be a coordinated operation based on identical functionality and infrastructure patterns. It specifically involves exfiltrating cookies to a remote server under the attackers’ control, manipulating the Document Object Model (DOM) tree to block security administration pages, and facilitating session hijacking via cookie injection.
Once installed, DataByCloud Access requests permissions for cookies, management, scripting, storage, and declarativeNetRequest across Workday, NetSuite, and SuccessFactors domains. It also collects authentication cookies for a specified domain and transmits them to the “api.databycloud[.]com” domain every 60 seconds.
“Tool Access 11 (v1.4) prevents access to 44 administrative pages within Workday by erasing page content and redirecting to malformed URLs,” Pandya explained. “This extension blocks authentication management, sec
