Stanley Malware Toolkit: Russian-Made Chrome Extension Phishing Service

Stanley was first observed on January 12, 2026, in promotional posts on Russian-language cybercrime forums. Pricing ranges from $2,000 to $6,000, with the highest-tier “Luxe Plan” offering customization, a centralized control panel, and a guarantee that the extension will be approved and published on the Chrome Web Store.

This publication guarantee significantly lowers risk for attackers and undermines a core assumption of browser security—that official extension marketplaces can be trusted. Varonis researchers note this suggests a reliable method for bypassing Google’s review process.

How the Control Panel Works

Stanley includes a web-based control panel that allows attackers to manage phishing operations in real time. The panel tracks victims primarily by IP address and displays online status, activity timestamps, and browser data availability. This enables geographic targeting and persistent victim tracking across sessions.

Attackers can define per-victim website hijacking rules, mapping legitimate URLs to attacker-controlled phishing pages. These rules can be enabled or disabled dynamically, allowing precise timing of attacks. Critically, victims continue to see the legitimate URL in the address bar while interacting with malicious content, defeating common security awareness checks.

The toolkit also supports real-time push notifications that appear to originate from Chrome itself, further increasing credibility and user trust.

Analysis of the Notely Extension

Varonis analyzed a malicious extension built with Stanley that masquerades as Notely, a simple note-taking and bookmarking tool. This benign appearance helps justify broad permissions, attract positive reviews, and pass security reviews before malicious functionality is activated.

Despite its appearance, the extension requests extensive permissions, including access to all websites, tabs, navigation, storage, scripts, and notifications. Its code executes before legitimate page content loads.

The extension maintains continuous command-and-control communication, polling api.notely.fun every 10 seconds. Backup servers are embedded to ensure resilience against takedowns.

The Attack Method

When a victim visits a targeted site, the extension intercepts the request and overlays a full-screen phishing page on top of the legitimate content. Normal navigation is blocked, the real page is hidden, and users interact exclusively with attacker-controlled content while the address bar still displays the correct domain (e.g., binance.com or coinbase.com).

The extension also strips security headers designed to prevent page overlays, allowing attacks even on sites with strong defensive controls.

Code Quality and Origins

While effective, the code lacks sophistication. Researchers observed Russian-language comments, inconsistent quality, and crude error handling, suggesting rapid development focused on functionality rather than maintainability. Combined with forum activity and the seller’s identity, this strongly indicates Russian origin. Its pricing reflects the value of guaranteed publication and operational convenience rather than advanced engineering.

Risks and Impact

Stanley significantly increases phishing risk by enabling large-scale distribution through the Chrome Web Store. Stolen credentials can lead to financial loss, operational disruption, regulatory exposure, and reputational damage.

The toolkit’s ease of use lowers the barrier to entry, enabling even low-skill attackers to run effective campaigns. Sectors handling sensitive data—finance, healthcare, and government—are particularly exposed.

Response and Current Status

Varonis reported the toolkit and Notely extension to Google and the hosting provider on January 21, 2026. The command-and-control infrastructure was taken offline the next day.

Update (January 27, 2026): The Notely extension has been removed from the Chrome Web Store, and the sellers have ceased public forum activity. Researchers caution that the toolkit may resurface under a different name or shift to private distribution.

How to Protect Yourself

Guaranteed Web Store publication weakens traditional advice such as “only install extensions from official stores.” Malicious extensions may remain active for long periods before detection.

For Organizations

Enterprise environments should implement strict extension allowlisting policies. Chrome Enterprise and Edge for Business let administrators block all extensions by default except those that have been explicitly approved. While this requires additional work to maintain approved extension lists and handle user requests, it effectively prevents threats that bypass store-level security. Organizations should also:

For Individual Users

Technical Indicators

Network

Extension

Behavioral

Summary

The Stanley malware toolkit represents a notable escalation in browser-based phishing. By guaranteeing Chrome Web Store publication, it erodes trust in official extension ecosystems and enables wide-scale abuse by attackers of varying skill levels.

At the offering price the toolkit is accessible, effective, and likely to inspire copycat services. Organizations and individuals must treat the browser as a critical security boundary, relying on active controls and informed decision-making rather than implicit trust in marketplace vetting.

References: