The harmful extensions discovered in this attack are:
- DataByCloud Access Extension ID: oldhjammhkghhahhhdcifmmlefibciph Publisher: databycloud1104 Installs: 251
- Tool Access 11 Extension ID: ijapakghdgckgblfgjobhcfglebbkebf Publisher: databycloud1104 Installs: 101
- DataByCloud 1 Extension ID: mbjjeombjeklkbndcjgmfcdhfbjngcam Publisher: databycloud1104 Installs: 1,000
- DataByCloud 2 Extension ID: makdmacamkifdldldlelollkkjnoiedg Publisher: databycloud1104 Installs: 1,000
- Software Access Extension ID: bmodapcihjhklpogdpblefpepjolaoij Publisher: Software Access Installs: 27
When researchers conducted their analysis, all extensions other than Software Access had been deleted from the Chrome Web Store. Nevertheless, multiple extensions continue to be accessible via third-party software distribution websites like Softonic. These add-ons were marketed as efficiency or access-improvement utilities claiming to offer premium capabilities for enterprise systems such as Workday and NetSuite. Significantly, DataByCloud 1 and DataByCloud 2 were initially released as far back as August 18, 2021, suggesting extended vulnerability periods.
Campaign
Although released under two separate developer accounts, Socket determined this represented a single unified campaign based on matching functionality, common infrastructure elements, identical defensive evasion techniques, and uniform command-and-control architecture. The extensions together execute three primary functions: authentication cookie theft, administrative console suppression through DOM modification, and session takeover via cookie injection.
After installation, DataByCloud Access demands extensive permissions, including cookie access, extension management APIs, scripting capabilities, local storage, and declarativeNetRequest, targeted specifically at Workday, NetSuite, and SuccessFactors domains. The extension methodically captures authentication cookies linked to these systems and transmits them to the attacker’s controlled server at api.databycloud[.]com every 60 seconds.
Tool Access 11 (version 1.4) concentrates on disabling incident response by actively preventing access to 44 essential Workday administrative pages. This is accomplished by erasing page content and forcing users toward invalid URLs. The blocked features encompass authentication management, security proxy settings, IP allowlisting, session oversight, and other security-critical administration interfaces. This functionality operates through persistent DOM monitoring, with the extension checking page titles against a predetermined blocklist.
DataByCloud 2 enhances this functionality significantly, expanding the blocklist to 56 administrative and security pages. Beyond previously targeted controls, it blocks access to password reset processes, account deactivation capabilities, multi-factor authentication device administration, and security audit logs. The extension is specifically programmed to target both live Workday deployments and Workday’s testing infrastructure located at workdaysuv[.]com.
Simultaneously, DataByCloud 1 replicates the credential-stealing functionality of DataByCloud Access while adding anti-analysis defenses. Particularly, it utilizes the open-source DisableDevtool library to prevent browser developer tools from functioning, impeding manual examination and reverse engineering of the extension’s operations. Both DataByCloud 1 and DataByCloud 2 encrypt their command-and-control communications to hide data theft and command activity.
The most sophisticated element of the campaign is Software Access, which goes beyond credential theft to enable active session replication. Beyond stealing authentication cookies, the extension can retrieve stolen session information from api.software-access[.]com and insert it directly into the victim’s browser. The injection mechanism parses cookies obtained from the server, removes any current cookies for the targeted domain, and reinstalls the attacker-provided values using the chrome.cookies.set() API. This method effectively duplicates an authenticated session, permitting the threat actor to impersonate the victim without needing credentials. The extension also implements safeguards around password input fields to stop users from examining or intercepting credential entry activity.
Features
A common feature across all five extensions is the inclusion of an identical hardcoded list of 23 security-oriented Chrome extensions, including utilities such as EditThisCookie, Cookie-Editor, ModHeader, Redux DevTools, and SessionBox. The extensions scan for the presence of these utilities and communicate their detection to the operator, presumably as a method of identifying environments where cookie manipulation or extension analysis might be detected.
According to Socket, this defensive monitoring indicates an intention to identify and respond to environments where the campaign’s operations could be interrupted or revealed. The repeated use of identical monitoring code and extension ID lists across all samples provides additional evidence of attribution to either a single threat actor using multiple publisher identities or a common malicious extension toolkit.
Immediate Remediation Steps
Chrome users who have installed any of these affected extensions are urgently recommended to uninstall them immediately, change all passwords linked to Workday, NetSuite, and associated platforms, and examine access logs for evidence of unauthorized sessions coming from unknown IP addresses or devices. The combined deployment of continuous credential theft, administrative interface blocking, and session takeover generates a high-risk situation in which security teams may identify suspicious access but are effectively blocked from addressing it through normal administrative controls.