Malicious Chrome Extension 'CL Suite' Steals Meta Business

Chrome Extension Targets Meta Business Accounts

Security researchers have discovered a malicious Chrome extension called "CL Suite" that specifically targets Meta Business Manager users, stealing TOTP two-factor authentication seeds, business analytics data, and personnel information — effectively neutralizing 2FA protections entirely.

Attack Overview

How It Works

TOTP 2FA Seed Theft

The most dangerous capability is intercepting TOTP seeds during 2FA setup or re-authentication:

1. The extension monitors page content for TOTP seed values
2. Intercepts QR code data or secret key during setup
3. Exfiltrates the seed to attacker infrastructure

With the TOTP seed, attackers can generate valid 2FA codes at will, completely bypassing two-factor authentication.

Meta Business Data Harvesting

Beyond 2FA theft, the extension harvests:

• People CSV exports — Employee names, roles, emails, permission levels
• Business Manager analytics — Ad spend, campaign performance, audience insights, revenue data

Exfiltration

All stolen data is sent to:

1. getauth[.]pro — Purpose-built C2 domain for 2FA seeds and business data
2. Telegram channel — Real-time attacker notifications when new data is captured

Why This Is Dangerous

Meta Business Manager accounts often control large advertising budgets (sometimes millions of dollars), company pages with significant followings, and customer data from lead generation campaigns. Account takeover can lead to unauthorized ad spend, brand damage, and data breaches.

Software-based TOTP is vulnerable when the seed can be intercepted at the browser level — this extension demonstrates that browser extensions operate at a privileged level that can observe and modify any web page content.

Protection Recommendations

1. Audit Chrome extensions — Review all installed extensions in chrome://extensions
2. Use hardware security keys — FIDO2/WebAuthn keys (YubiKey, Titan Key) are immune to seed theft
3. Implement extension allowlisting via Chrome enterprise policies
4. Rotate 2FA seeds — If you suspect compromise, disable and re-enable 2FA
5. Review Meta Business access — Check the "People" section for unauthorized users
6. Separate browsing profiles — Use a dedicated profile for business account management
7. Monitor network traffic — Block connections to getauth[.]pro

Sources

• The Hacker News — Malicious Chrome Extension Steals Meta Business Data
• Socket.dev — CL Suite Chrome Extension Analysis

Related Reading

• Claude AI Artifacts Abused to Distribute macOS Infostealer
• PromptSpy: First Android Malware to Weaponize Generative AI
• Google Disrupts Massive Chinese Espionage Campaign