A recently identified malicious Chrome extension campaign is targeting Meta advertisers by impersonating an AI-powered ad optimization platform named “Madgicx Plus.”
Operators distribute the extension through a rotating network of lure domains such as privacy-shield. World, madgicxads. World, and madgicx-plus.com, hosted behind Cloudflare to obscure origin.
By configuring “www” and non-“www” host-header routing on the same IP address (185.245.104[.]195, hosted by VDSina), attackers serve themed landing pages that convincingly mimic legitimate advertising tools.
Favicon-hash matching and Shodan scans revealed that this infrastructure also hosted earlier malicious extensions like Debank, indicating resource reuse and an evolving campaign rather than isolated copycat operations.
Landing pages crafted for “Madgicx Plus” employ familiar marketing rhetoric touting AI-driven campaign management and ROI optimization.
Once visitors click the download prompt, they install “madgicx-plus-the-superapp” (ID eoalbaojjblgndkffciljmiddhgjdldh), which appears in the Chrome Web Store as a productivity enhancer.
In parallel, a variant named “Meta Ads SuperTool” (ID cpigbbjhchinhpamicodkkcpihjjjlia) uses madgicxads.world as its lure domain, further diversifying the campaign branding while leveraging the same hosting backend.
Extension Capabilities and Mitigation
Static analysis of the extension’s manifest.json reveals that it requests full host permissions across all websites, along with declarativeNetRequest and declarativeNetRequestWithHostAccess.
This combination permits the extension to inject custom content scripts into every visited page, intercept and modify network requests, and strip critical HTTP headers.
A rules.json entry specifically removes the Origin header from requests containing “caller=ext,” bypassing CORS protections on Meta’s platforms.
The background. life.js script then utilizes stolen session tokens to call Meta’s internal APIs, enabling unauthorized management of advertising assets without user credentials.
Dynamic analysis in a sandbox demonstrates the threat actor’s staged data capture approach: the extension first initiates an OAuth flow to acquire Google identity tokens, storing them persistently in local storage.
It subsequently prompts users to connect their Facebook accounts, expanding access to high-value business sessions. All exfiltrated tokens and commands route through a C2 endpoint at hxxps://madgicx-plus[.]com, facilitating real-time control and data theft.
To safeguard against similar threats, organizations should enforce strict extension installation policies via enterprise management controls, limiting installations to vetted publishers.
Digital marketers must scrutinize extension permissions, remove unused browser add-ons, and segregate workflows using dedicated Chrome profiles for advertising tasks.
Technically adept users should download CRX packages for manual code inspection, looking for suspicious network rules or header-manipulation logic.
Reporting suspect extensions to the Chrome Web Store and sharing IOCs with peers can disrupt the campaign’s momentum and protect the broader advertising ecosystem.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
