TheHatman is hawking Azure Entra ID directory dumps from McDonald's, TCS, Vodafone and more on dark web. https://intel.threadlinqs.com/threat/TL-2026-2028 #ThreatIntel #TheHatman #AzureEntraID #SessionTheft
August 16, 2026 at 3:11 PM
TheHatman is hawking Azure Entra ID directory dumps from McDonald's, TCS, Vodafone and more on dark web. https://intel.threadlinqs.com/threat/TL-2026-2028 #ThreatIntel #TheHatman #AzureEntraID #SessionTheft
108 malicious Chrome extensions linked to a shared C2 infrastructure have been found stealing Google identities, Telegram Web sessions, browsing data, and injecting ads via sophisticated backdoors. #DataExfiltration #SessionTheft #Telegram
108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure
Socket's Threat Research Team discovered 108 malicious Chrome extensions that share a single C2 infrastructure at cloudapi[.]stream and collectively account for about 20k installs under five publisher identities, exfiltrating Google identities, Telegram Web sessions, browsing data, and opening attacker-specified URLs. The campaign includes OAuth-based identity harvesting, a Telegram Web session stealer (Telegram Multi-account) that exfiltrates sessions every 15 seconds, a universal loadInfo() backdoor, and header-stripping declarativeNetRequest rules used to inject ads and bypass protections; #TelegramMultiAccount #cloudapi_stream
www.hendryadrian.com
April 14, 2026 at 1:15 PM
108 malicious Chrome extensions linked to a shared C2 infrastructure have been found stealing Google identities, Telegram Web sessions, browsing data, and injecting ads via sophisticated backdoors. #DataExfiltration #SessionTheft #Telegram