Malicious Chrome Extension Usage - Cloudapi C2 Network Activity

Tim Peck@timpeck

•updated Apr 14, 2026•14•0•229

Detects DNS requests directed to the cloudapi[.]stream domain, which is associated with a widespread malicious Chrome extension campaign involving over 100 extensions. Monitoring for this specific domain allows defenders to identify compromised hosts regardless of the specific extension ID.