108 Malicious Chrome Extensions Found Stealing Google OAuth Tokens and Telegram Sessions

Analysis
The five-publisher structure, splitting malicious functionality across publisher identities while routing all exfiltrated data to a single operator, exploited Chrome Web Store's review process through distributed evasion, and the architecture holds the operational story: valid OAuth bearer tokens bypass MFA and persist across sessions, making this campaign likely oriented toward targeted account takeover or espionage among high-value individuals within the 20,000-install pool rather than opportunistic mass fraud. Per converging researcher reporting, the 20,000-across-108-extensions footprint is either a ceiling imposed by early detection or a deliberate ceiling the operator chose to stay below Google's abuse-detection thresholds; the latter would indicate a more sophisticated actor actively calibrating exposure risk.