These Chrome extensions spoof Workday, NetSuite, and others to trick victims
- here's what to look for

Date:
Mon, 19 Jan 2026 18:30:00 +0000

Description:
Five extensions were found targeting enterprises and multinational organizations, taking over valuable accounts.

FULL STORY ======================================================================Socket found five malicious Chrome extensions spoofing HR/ERP platforms Extensions enabled credential theft, session hijacking, and blocked incident response Removed from Chrome Store, but still on third-party sites

If you are using Workday, NetSuite, or SuccessFactors at work, you might want to pay attention to the browser extensions or add-ons you have installed, because you may have inadvertently installed malware.

Security researchers Socket have warned of discovering five Chrome
extensions, spoofing popular human resource (HR) software and enterprise resource planning (ERP) platforms.

The plugins are designed to steal authentication tokens, block incident response capabilities, or grant full account takeover via session hijacking, the researchers explained. Thousands of victims

Here is the full list of malicious extensions:

DataByCloud Access
Tool Access 11
DataByCloud 1
DataByCloud 2
Software Access

By the time the news hit the web, all five were already removed from the Google Chrome Web Store. Still, users who installed them before wont be entirely secure until they uninstall the plugins and run a thorough scan to see if the infection had been cleaned.

Furthermore, The Hacker News reports that the plugins are still available on third-party software download sites such as Softonic, but we couldnt independently verify these claims since Softonics site seemed to be offline
at press time.

Cumulatively, these five add-ons were downloaded 2,739 times, which suggests the campaign was not particularly effective.

Still, Workday, NetSuite, and SuccessFactors are usually used by medium to large organizations, including enterprises and multinational firms, for HR, finance, payroll, and operations teams. A full account takeover in just one such organization can turn into a large-scale cyberattack with millions of dollars of damages and thousands of affected individuals.

To make matters even worse, some of the extensions taken down were first published more than four years ago.

"The combination of continuous credential theft, administrative interface blocking, and session hijacking creates a scenario where security teams can detect unauthorized access but cannot remediate through normal channels," Socket said.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the
Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.



======================================================================
Link to news story: https://www.techradar.com/pro/security/these-chrome-extensions-spoof-workday-n etsuite-and-others-to-trick-victims-heres-what-to-look-for


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)