Poisoned Pipeline / Incidents / AS158

AS158 · 2026-04

108 Chrome extensions shared-C2 session theft

Browser extensions

Socket: 108 Chrome extensions linked to data exfiltration and session theft via shared C2.

Mapped techniques

• T0109 Publish malicious artifact
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/108-chrome-ext-linked-to-data-exfil-session-theft-shared-c2