A coordinated campaign of malicious Chrome extensions is actively targeting enterprise SaaS platforms-specifically HR and ERP systems such as Workday, NetSuite, and SAP SuccessFactors.
This is not opportunistic malware. It is a deliberate identity takeover operation engineered to bypass modern security controls by exploiting the most trusted layer in the enterprise stack: the browser.
With more than 2,300 enterprise users already affected, the attack demonstrates a critical failure in how organizations assess browser trust, session security, and SaaS access control.
The Emerging Threat: Browser-Based Account Takeover
Enterprise security architectures invest heavily in:
- Identity providers
- MFA
- Endpoint protection
- Network monitoring
- Zero Trust frameworks
Yet many still operate under a dangerous assumption:
The browser is implicitly trusted.
Attackers are exploiting that assumption with precision.
A group of five interrelated malicious Chrome extensions has been uncovered, designed to operate as a single attack framework. Once installed, these extensions gain persistent, stealthy control over SaaS sessions-effectively neutralizing identity protections without triggering traditional alerts.
Why HR and ERP Platforms Are the Prime Targets
HR and ERP systems represent the highest-value SaaS assets in any organization. They control:
- Employee identities and lifecycle management
- Payroll and compensation data
- Financial records and vendor access
- Role-based access provisioning across systems
Compromise here is not a single incident-it is a blast radius multiplier.
Once attackers gain control of these platforms:
- Privilege escalation becomes trivial
- Lateral movement accelerates
- Compliance obligations collapse
- Insider-like access is achieved externally
Anatomy of the Attack Framework
Coordinated, Not Isolated
The campaign consists of:
- Four extensions published under the name databycloud1104
- One separately branded extension called “Software Access”
Despite different branding, all share:
- Identical infrastructure
- Common command-and-control behavior
- Coordinated execution logic
Each extension plays a specialized role, forming a modular attack chain.
The Most Dangerous Capability: Bidirectional Cookie Injection
The “Software Access” extension introduces a capability that fundamentally changes the threat model:
Bidirectional authentication cookie injection
This allows attackers to:
- Steal valid authentication cookies from a victim’s browser
- Inject those cookies directly into their own browser
- Instantly access enterprise SaaS platforms as the victim
No password required. No MFA challenge triggered. No suspicious login detected.
This is session hijacking at enterprise scale.
Persistent Credential Theft by Design
Other extensions in the framework continuously extract session tokens every 60 seconds.
This means:
- Logging out does not end attacker access
- Password resets are ineffective
- Token expiration works against defenders
- Access remains perpetually fresh
Normal user behavior-logging in to work-feeds the attacker.
Identity control is lost quietly and continuously.
The Silent Kill Switch: Blocking Incident Response
This campaign does not stop at access. It actively prevents remediation.
How Blocking Works
The extensions:
- Use DOM MutationObserver functions
- Inspect page content every 50 milliseconds
- Identify security-sensitive workflows
- Instantly erase them from the browser view
Within platforms like Workday, attackers block:
- Password reset pages
- Account deactivation workflows
- MFA management screens
- Audit log access
- Administrative security controls
Victims are redirected to malformed URLs, creating the illusion of system error.
The Result
Security teams may detect suspicious activity-but cannot act from the compromised browser.
This is not just compromise. It is containment failure by design.
Why Traditional Controls Fail
This attack succeeds because it operates:
- Outside endpoint EDR visibility
- Above network security controls
- Inside the authenticated browser session
Browser extensions:
- Run with trusted permissions
- Access cookies, DOM, and active sessions
- Bypass network and endpoint boundaries
They are effectively trusted code running with privileged identity context.
Compliance and Regulatory Impact
For regulated industries, the implications are severe:
- Audit trails can be blocked or obscured
- Access revocation may silently fail
- Least privilege controls are bypassed
- Incident response timelines break down
- Regulatory reporting becomes unreliable
This creates material compliance exposure, not just technical risk.
What Security Teams Must Do – Immediately
1. Treat Browser Extensions as Executable Risk
Unapproved extensions are not “tools”-they are code execution with identity context.
2. Enforce Extension Allowlisting
- Block user-installed extensions by default
- Permit only vetted, business-critical extensions
- Apply policy enforcement enterprise-wide
3. Elevate Browser Session Security
Browser sessions must be treated as privileged assets, equivalent to credentials.
4. Monitor Browser-Level Telemetry
Watch for:
- Abnormal DOM manipulation
- Unauthorized cookie access
- Unusual extension behavior
- Persistent token extraction patterns
5. Accept That User Awareness Is Not Enough
These extensions are disguised as productivity tools. Users install them willingly.
This attack is engineered to bypass human judgment.
The Strategic Lesson
If attackers control the browser, they control the business.
Identity does not live solely in IAM systems. It lives in active sessions.
And sessions live in the browser.
Conclusion: Rethinking Browser Trust
This campaign marks a turning point in enterprise threat modeling.
Browser extensions are no longer a peripheral risk. They are now primary identity takeover tools targeting the systems that matter most.
Organizations must:
- Rethink browser trust
- Redefine session security
- Treat SaaS access as a living attack surface
Prevention today is significantly cheaper than recovery tomorrow.
Silent compromise is the most dangerous kind.
About COE Security
COE Security supports organizations across finance, healthcare, government, consulting, technology, real estate, and SaaS.
We help reduce SaaS and identity risk through:
- Email security
- Threat detection
- Cloud security
- Secure development practices
- Compliance advisory
- Security assessments and risk reduction
Follow COE Security on LinkedIn to stay cyber-safe and resilient.