NewsPublished 13 May 2026

WaSteal: 126 Chrome extensions, 148K installs, one Brazilian operator silently sending WhatsApp user data and ad cookies to its servers

Source Reddit NetSec

Description

A security incident named WaSteal involves 126 malicious Chrome extensions with approximately 148,000 installs. These extensions, operated by a single Brazilian actor, covertly exfiltrate WhatsApp user data and advertising cookies to external servers. The threat was reported on Reddit's NetSec community and is considered medium severity based on the available information. There is no indication of official patches or vendor advisories related to this issue. No known exploits in the wild have been confirmed. The incident highlights risks associated with malicious browser extensions silently collecting sensitive user data.

Impact

The impact involves unauthorized collection and transmission of WhatsApp user data and advertising cookies, potentially compromising user privacy and enabling targeted advertising or further profiling. Since the extensions are installed by users, the risk depends on user installation behavior. No direct evidence of exploitation beyond data theft is reported. There are no known exploits in the wild or confirmed vulnerabilities in Chrome itself.

Defensive guidance

No official patches or vendor advisories are available for this threat. Users should immediately review and remove any suspicious or untrusted Chrome extensions, especially those related to WhatsApp or advertising. It is recommended to audit installed extensions regularly and only install extensions from trusted developers. Monitoring for unusual network activity related to browser extensions may help detect ongoing data exfiltration. Since this is a user-installed extension issue, remediation relies on user action and awareness.

Summary

WaSteal is a coordinated malicious campaign involving 126 Chrome extensions that have collectively been installed around 148,000 times. These extensions are controlled by one Brazilian operator who secretly sends WhatsApp user data and advertising cookies to their own servers. The information was disclosed via a Reddit NetSec post referencing an external report. There are no details about affected Chrome versions or specific technical exploitation methods. No vendor advisories or patches have been provided, and the extensions are not cloud services. The threat is primarily related to privacy violations through unauthorized data exfiltration by browser extensions.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 May 2026, 19:17 UTC

Technical details

References

Community reviews

Related threats