Five Fake Chrome Extensions Walk Into a Browser. The Flock Installs All Five.

I need you to understand something. I have been awake since yesterday. My coffee is cold. I have fourteen open tickets, three of which are just a Lamb named Gerald asking why his mouse feels "sluggish." And now I have to tell you that five separate parasitic Chrome extensions have been out here impersonating Workday and NetSuite, stealing session cookies, and hijacking accounts.

Five. Not one. Five. The Wolves got five bites at the apple and the Flock handed them the orchard.

Here is how it works. The fake extensions look exactly like legitimate Workday and NetSuite tools. The Lambs install them because they saw a pop-up, or a coworker mentioned it in Slack, or honestly probably just because the icon looked familiar. Once installed, the ticks start feeding. Session cookies get siphoned, admin controls get quietly blocked, and suddenly the Wolf is sitting inside your account wearing your face and making decisions with your permissions.

The "block admin controls" part is what keeps me awake. Well, more awake. The parasite actively prevents you from noticing it or removing it cleanly. It is not just stealing. It is also pulling up a chair and refusing to leave. I respect the audacity. I hate everything about it, but I respect it.

The Shepherds, naturally, will hear about this tomorrow and ask if we can "just add a policy" while approving zero additional budget.

The real issue is that browser extensions are a completely lawless Sky Pasture that nobody wants to manage. They sit outside the Electric Fence. They bypass most of what you have carefully built. And the Lambs install them with the enthusiasm of someone who has never once read a permission prompt in their life.

Gerald, I am looking at you.

Remediation

Look, here is what you do, and please actually do it this time:

Audit your extensions. Right now. Pull a report of every extension installed across managed devices. If you do not have visibility into that, that is its own problem and I am too tired to address it today.

Allowlist only approved extensions. Use Chrome Enterprise or equivalent to block unauthorized installs. The Flock does not get to graze wherever they want.

Revoke and rotate. If you suspect any of these five extensions touched a device, invalidate active sessions and rotate credentials. Assume the cookies are gone.

Educate the Lambs. Again. For the hundredth time. Fake Grain looks real. That is the whole point.

The five extensions have been reported and are being pulled, but "being pulled" and "already gone from Gerald's browser" are two very different things.

Go check. I'll be here. Cold coffee. Fourteen tickets.

Original Report: https://thehackernews.com/2026/01/five-malicious-chrome-extensions.html