{"id":10708,"date":"2026-02-17T10:04:57","date_gmt":"2026-02-17T10:04:57","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/17\/malicious-chrome-extension-steals-facebook-business-manage-2fa-codes-and-analytics-data\/"},"modified":"2026-02-17T10:04:57","modified_gmt":"2026-02-17T10:04:57","slug":"malicious-chrome-extension-steals-facebook-business-manage-2fa-codes-and-analytics-data","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/17\/malicious-chrome-extension-steals-facebook-business-manage-2fa-codes-and-analytics-data\/","title":{"rendered":"Malicious Chrome Extension Steals Facebook Business Manage 2FA Codes and Analytics Data"},"content":{"rendered":"

Malicious Chrome Extension Steals Facebook Business Manage 2FA Codes and Analytics Data
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A malicious Chrome extension that claims to help Meta Business users quietly\u00a0steals<\/a><\/span> Facebook Business Manager <\/a>2FA codes and analytics data, putting high\u2011value ad accounts at risk of takeover.<\/p>\n

The extension, \u201cCL Suite by @CLMasters\u201d (ID: jkphinfhmfkckkcnifhjiplhfoiefffl), is still available in the Chrome Web Store and specifically targets Meta Business Suite and Facebook Business Manager environments.<\/p>\n

\"Socket
Socket AI Scanner\u2019s analysis of the malicious CL Suite by @CLMasters Chrome extension (source: socket)<\/figcaption><\/figure>\n

Marketed as a utility to \u201cextract people data, analyze Business Managers, remove verification popups, and generate 2FA codes,\u201d CL Suite requests broad permissions over meta.com and facebook.com.<\/p>\n

From Productivity Tool to Infostealer<\/strong><\/h2>\n

Its privacy policy claims that 2FA secrets and Business Manager data remain local in the browser. However, technical analysis shows the extension behaves more like an\u00a0infostealer<\/a> than a productivity tool.<\/p>\n

Socket\u2019s Threat Researchers found that it systematically abuses the very features it advertises to harvest authentication secrets and business intelligence from authenticated admin sessions.<\/p>\n

The most serious issue is how the extension handles two\u2011factor authentication<\/a> for Facebook and Meta Business accounts.<\/p>\n

\"Chrome
Chrome Web Store listing for the\u00a0CL Suite by @CLMasters<\/code>\u00a0extension ( source : socket)<\/figcaption><\/figure>\n

When users rely on its built\u2011in 2FA generator, CL Suite captures the TOTP seed<\/a>, the current 6\u2011digit 2FA code.<\/p>\n

The associated Facebook username and email are then sent to an attacker\u2011controlled infrastructure at getauth[.]pro, with an option to forward it to a Telegram channel.<\/p>\n

With both the seed and a timestamped, valid code, attackers can continue to generate working 2FA codes indefinitely, making it easy to hijack accounts once passwords<\/a> or recovery channels are obtained from infostealers or credential dumps.<\/p>\n

Business Manager Contacts and Analytics Harvested<\/strong><\/h2>\n
\"Meta\u2019s
Meta\u2019s official business tools page (source: socket)<\/figcaption><\/figure>\n

The extension also aggressively targets Meta Business Manager data.<\/p>\n

A \u201cPeople\u201d extraction feature scrapes the Business Manager \u201cPeople\u201d view, builds CSV files with names, email addresses, roles, status, and access levels, and silently exfiltrates those CSVs to the same backend, often marked for Telegram forwarding.<\/p>\n

Another analytics component enumerates Business Manager IDs, linked ad accounts, connected pages, and billing or payment configurations, giving attackers a complete map of business assets and how ad spend is funded.<\/p>\n

\"Privacy
Privacy policy page for Meta Business Suite Tools on\u00a0clmasters[.]pro<\/code><\/em>(source: socket)<\/figcaption><\/figure>\n

Even with a limited install base, this visibility is enough to identify successful targets and plan follow\u2011on fraud or account\u2011takeover activity.<\/p>\n

According to Socket\u2019s Threat Research,<\/a> organizations using Meta Business or Facebook Business Manager should audit browser extensions, remove CL Suite, and treat affected accounts as compromised.<\/p>\n

Recommended steps include re\u2011enrolling 2FA with fresh secrets, reviewing Business Manager roles and members, and monitoring for traffic to getauth[.]pro and related infrastructure.<\/p>\n

Long-term, enterprises should enforce extension allow\u2011lists for admin browsers and closely scrutinize any plugin that offers scraping, verification bypass, or in\u2011browser 2FA generation for high\u2011value platforms.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Malicious Chrome Extension Steals Facebook Business Manage 2FA Codes and Analytics Data<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Malicious Chrome Extension Steals Facebook Business Manage 2FA Codes and Analytics Data A malicious Chrome extension that claims to help Meta Business users quietly\u00a0steals Facebook Business Manager 2FA codes and analytics data, putting high\u2011value ad accounts at risk of takeover. The extension, \u201cCL Suite by @CLMasters\u201d (ID: jkphinfhmfkckkcnifhjiplhfoiefffl), is still available in the Chrome Web […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[768,1636,129,63],"tags":[130],"class_list":["post-10708","post","type-post","status-publish","format-standard","hentry","category-chrome","category-cyber-attack-news","category-cyber-security","category-cyber-security-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10708"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10708"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10708\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}