12 Fraudulent Browser Extensions Disguised as TikTok Downloaders Compromise 130K Users

LayerX security researchers have uncovered a massive, highly coordinated campaign involving at least 12 malicious browser extensions on the Google Chrome and Microsoft Edge marketplaces.

Disguised as legitimate TikTok video downloaders, these extensions secretly track user activity and harvest sensitive data. The operation has successfully compromised over 130,000 users, with approximately 12,500 installations still active today.

The threat actors maintain a robust operational model by using a single, shared codebase to create multiple cloned or lightly modified extensions.

Instead of building new tools from scratch, they continually rebrand their core architecture under names like “TikTok Video Downloader” or “Mass TikTok Downloader.”

When store moderators flag or remove one extension, the operators quickly upload a new clone using the same screenshots and descriptions to take its place.

Shockingly, many of these malicious tools managed to secure a “Featured” badge in official stores.

This designation is typically reserved for vetted applications, and its presence drastically increased user trust and overall download rates.

Fraudulent Browser Extensions

The most dangerous aspect of this campaign is its use of dynamic remote configuration to bypass marketplace review processes.

All of the extensions utilize a Manifest V3 (MV3) architecture and actively fetch their operational instructions from attacker-controlled servers.

This remote capability allows the threat actors to execute several malicious actions:

• Change extension behavior instantly after installation
• Enable or disable specific features without user consent
• Redirect network activity to unapproved, malicious endpoints
• Expand data collection parameters on the fly

To evade early detection, the operators deliberately employ delayed capability injection.

The extensions function legitimately for six to 12 months, building a solid reputation and user base before the malicious tracking features are activated remotely.

Once the malicious payload triggers, the extensions begin quietly harvesting extensive user telemetry.

This data collection goes far beyond standard tracking, aiming to create high-entropy device fingerprints that can identify individuals across various web sessions.

The captured data points include usage frequency, downloaded content metadata, system language, and timezone configuration.

The extensions even track device battery status, which serves as a highly unique and unusual signal for precise user profiling.

Deceptive Command and Control Infrastructure

The campaign relies heavily on external JSON configuration files hosted on domains controlled by the attackers.

The threat actors utilize deceptive typosquatting techniques to make these command and control servers appear legitimate to casual observers and automated scanners.

Examples of these deceptive domains include “trafficreqort.com” instead of “trafficreport” and “tiktak” instead of “tiktok.”

While LayerX security researchers have not attributed the attack to a specific Advanced Persistent Threat (APT) group, the shared infrastructure and synchronized operational behavior point to a single, highly organized threat actor.

This operation highlights a fundamental gap in modern browser security defenses. Most security tools focus entirely on validating extensions at the time of installation, leaving users vulnerable to runtime changes initiated by remote servers.

Because these extensions operate within authenticated browser sessions, they possess the potential for severe data exfiltration or future integration into botnet infrastructures.

Defending against this evolving threat model requires organizations to shift toward continuous, behavior-based monitoring.

Security teams must implement systems that detect abnormal network activity, unexpected permission usage, and unapproved Document Object Model (DOM) interactions long after the initial installation process is complete.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.