131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign
Source The Hacker News
Rated by Threat Radar
Data as of 27 Oct 2025, 01:41 UTC
What to do
AI-suggested
European organizations should implement strict policies restricting the installation of browser extensions, especially those related to messaging automation, unless vetted through a formal approval process. Endpoint security solutions should be configured to detect and block known malicious or suspicious Chrome extensions, including those identified in this campaign. User education programs must emphasize the risks of installing unverified extensions and the potential consequences of automated spam messaging. Organizations using WhatsApp Web for business should monitor account activity for unusual bulk messaging patterns and coordinate with WhatsApp support to report suspicious behavior. Network monitoring can help identify anomalous outbound messaging traffic originating from endpoints. Security teams should collaborate with IT to enforce application whitelisting and leverage browser management tools to control extension deployment. Finally, organizations should stay informed about updates to Chrome Web Store policies and emerging threats related to browser extension abuse to adapt defenses accordingly.
Description
Cybersecurity researchers have uncovered a coordinated campaign that leveraged 131 rebranded clones of a WhatsApp Web automation extension for Google Chrome to spam Brazilian users at scale. The 131 spamware extensions share the same codebase, design patterns, and infrastructure, according to supply chain security company Socket. The browser add-ons collectively have about 20,905 active users. "