Malicious Chrome Extension Exposes Facebook Business Manager Accounts to 2FA and Analytics Theft

A malicious Google Chrome extension, CL Suite by @CLMasters, which masquerades as a productivity tool for Meta Business Suite while silently stealing sensitive authentication data.

Although the extension markets itself as a solution to “remove verification popups” and “generate 2FA codes,” its actual function is to exfiltrate Two-Factor Authentication (2FA) seeds, one-time codes, and detailed business analytics to a server controlled by cybercriminals.

Deceptive Functionality and Data Theft

The extension is published under the ID jkphinfhmfkckkcnifhjiplhfoiefffl and targets users managing high-value Facebook and Instagram assets.

Once installed, it requests broad permissions to access meta.com and facebook.com. While the developer’s privacy policy claims that all 2FA secrets and business data remain stored locally on the user’s browser, the underlying code tells a different story.

Socket’s analysis reveals that the extension captures Time-based One-Time Password (TOTP) seeds the secret keys used to generate 2FA codes.

It then transmits these seeds alongside the current valid code to a command-and-control server at getauth[.]pro.

This effectively bypasses 2FA protections because the attacker now possesses the “master key” to generate valid login codes at will.

The theft occurs instantly when a user interacts with the extension’s 2FA generator, with no warning or consent dialog appearing on the screen.

Beyond authentication secrets, the extension actively scrapes internal business intelligence.

The “People Extractor” module navigates through the Business Manager interface to harvest lists of employees, their email addresses, and their specific access levels.

Simultaneously, a background analytics script enumerates ad accounts and payment configurations .

All stolen data is packaged into JSON payloads and sent to the attacker’s API. The code also includes a specific flag, sendTelegram: true, which instructs the backend to immediately forward the stolen credentials and business data to a private Telegram channel .

This allows the threat actors to receive real-time updates whenever a victim uses the tool, enabling rapid account takeover or ad fraud.

Indicators of Compromise (IOCs)

Security teams should scan their environments for the following indicators associated with this threat.

Indicator Type	Value	Description
Extension Name	CL Suite by @CLMasters	Malicious extension name
Extension ID	jkphinfhmfkckkcnifhjiplhfoiefffl	Unique Chrome Web Store ID
C2 Domain	getauth[.]pro	Primary data exfiltration endpoint
API Endpoint	https://getauth[.]pro/api/telemetry.php	URL receiving stolen data
Hardcoded Key	w7ZxKp3F8RtJmN5qL2yAcD9v	Bearer token used for authorization
Developer Email	info@clmasters[.]pro	Associated developer contact

The impact of this extension persists even after it is uninstalled because the attackers retain the stolen 2FA seeds.

Possession of these seeds means they can generate valid login codes indefinitely.

Organizations identified as using this extension must immediately uninstall it, revoke all active sessions for affected users, and most importantly, rotate their 2FA secrets by removing and re-adding their authentication method.

Failure to reset the 2FA configuration leaves the account vulnerable to takeover if the password is ever compromised.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google