Fake GoogleTranslate Chrome Extension Lets Attackers Remotely Control Your Browsers

A malicious Chrome extension masquerading as GoogleTranslate that can steal sensitive browser data, live-stream web sessions, and allow threat actors to remotely interact with Chrome windows while keeping their activity out of the victim’s view.

The operation begins with a suspected Rust-based malware loader. VMRay researchers found that the binary drops a malicious Chrome extension alongside an AutoIt script, which subsequently deploys the Stealcv2 information-stealing malware.

The multi-stage infection chain gives attackers both traditional endpoint-stealing capabilities and unusually deep control over the victim’s browser environment.

Once installed, the fraudulent extension can collect a broad range of browser-resident data. This includes browsing history, saved bookmarks, installed extension details, cookies, and stored credentials.

Such information can help attackers hijack online accounts, bypass session-based protections, profile victims, and identify high-value services such as email, cryptocurrency platforms, cloud consoles, and corporate applications.

The most concerning capability is its ability to provide attackers with a real-time view of Chrome windows and let them operate websites remotely using mouse clicks and keyboard input.

In effect, the browser becomes a remotely controlled interface for the threat actor. Chrome’s extension APIs can legitimately interact with tabs and, when granted relevant permissions, may access sensitive tab properties or inject scripts into matching websites—permissions that can be abused when users install an untrusted extension.

Unlike conventional remote-access malware, this campaign is designed to conceal interactive fraud. The extension reportedly enables remote control of browser windows that are out of focus, meaning attackers can perform actions in the background while the victim works in another application or window. This reduces the chance that a user will notice unauthorized clicks, navigation, or form submissions occurring in Chrome.

Researchers also observed features for setting a proxy and injecting attacker-controlled JavaScript into selected websites. Proxy configuration could help route browser traffic through infrastructure controlled by the attackers, while JavaScript injection can alter the content users see or manipulate sessions on targeted domains. This creates opportunities for account takeover, payment fraud, data theft, and targeted social engineering.

Another major risk is a man-in-the-browser phishing technique. The extension can overlay a legitimate website with an iframe that loads content from an attacker-controlled phishing page.

The browser’s address bar may still show the genuine domain, potentially convincing victims that they are interacting with a trusted login portal. Users could then submit passwords, multi-factor authentication codes, or payment details directly to criminals without realizing that the visible form is fraudulent.

The malware’s Google Translate branding is especially dangerous because translation extensions are common, useful, and rarely viewed as high-risk by users.

Threat actors have repeatedly abused trusted-looking browser add-ons to gain access to credentials, cookies, screenshots, and web sessions; a previous campaign linked to the Kimsuky threat actor used a Chrome extension hosted as “GoogleTranslate.crx” to collect account data and browser information.

Users should review installed Chrome extensions immediately, remove unfamiliar or unnecessary add-ons, and scrutinize permission requests—particularly broad access to website data.

Organizations should restrict unmanaged extensions, monitor for suspicious browser-policy changes, and require phishing-resistant multi-factor authentication to limit damage from stolen passwords and session data.

IoCs

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.