Executive Summary
A cluster of 108 malicious Chrome extensions, published under five different identities (including Rodeo Games and InterAlt), has been identified targeting approximately 20,000 users. These extensions, ranging from functional Telegram clients to slot games, operate on a shared command-and-control (C2) infrastructure hosted at cloudapi[.]stream. The campaign is sophisticated, utilizing Chrome's native APIs to harvest Google account metadata, bypass security headers via declarativeNetRequest, and exfiltrate Telegram Web sessions every 15 seconds.
The operation is likely structured as a Malware-as-a-Service (MaaS) platform, evidenced by a central backend CRM for victim management and a dedicated payment portal at topup[.]cloudapi[.]stream. The threat actor, potentially based in Ukraine given the domain registration and support emails, has successfully circumvented Chrome Web Store security audits by embedding legitimate surface-level functionality while concealing universal backdoors and content injection scripts in the background service workers.
This campaign represents a significant risk to both consumer and corporate users. Beyond simple data theft, the ability to replace active browser sessions and inject arbitrary content allows for full account takeover of Telegram and potentially other targeted services, bypassing multi-factor authentication (MFA) entirely.