108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure

Reported 14 Apr 2026 by otx · Severity: medium

A coordinated campaign of 108 malicious Chrome extensions operated through shared command-and-control infrastructure at cloudapi[.]stream has been identified, collectively accounting for approximately 20,000 installations. The campaign spans multiple threat categories: 54 extensi