A malware campaign that hijacked over 500,000 VKontakte accounts through five malicious Chrome extensions posing as customization tools.
The attack, active since June 2025, uses multi-stage payloads hosted on VK profiles and GitHub to evade detection while manipulating user accounts. This sophisticated operation highlights growing risks in browser extension marketplaces.
Discovery and Attack Chain
According to Koi, risk engine first flagged extensions injecting Yandex ad scripts, leading to VK Styles with 400,000 installs and a dynamically computed Yandex metric ID: ‘R-A-‘ + 843079 * 2, evaluating to R-A-1686158.
Deeper analysis revealed obfuscated code enabling arbitrary execution via a function E(), which fetched payloads from VK profile vk.com/m0nda’s metadata tags.
Key updates included CSRF manipulation in June, auto-subscriptions and 30-day resets in December, monetization via the VK Donut API in January, and stealth refinements such as removing IntersectionObserver code.
Malware Behaviors and Impact
The malware auto-subscribes users to group -168874636 (vk.com/club168874636, which redirects to vk.com/2style with 1.4M followers) with a 75% probability per VK session, driving viral growth through social proof and persistence.
Every 30 days (2592e6 ms), it resets feed to “recent,” sets message theme to 0, and overrides settings while tracking timestamps. It also manipulates the CSRF cookie remixsec_redir to bypass protections, enabling unauthorized API actions, and gates features based on donation status.
Total: 502,000+ victims, mainly Russian-speaking users in Eastern Europe, Central Asia, and diaspora. One extension was removed in 2024, but the actor pivoted to IDs; auto-updates allow instant payload pushes.
Thousands of users face forced subscriptions, resets, token tweaks, and monetization, turning their accounts into C2 nodes.
This campaign demonstrates trends such as social platforms, C2, self-propagation, subscription monetization, periodic persistence, and dynamic payloads.
Browser extensions’ high privileges and auto-updates make them prime vectors; tools like Koi aim to govern them. Users should remove suspicious extensions and monitor VK groups. Read more at Koi’s blog.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
