Fake Madgicx Plus and SocialMetrics Pro Chrome Extensions Found Stealing Facebook Credentials

Cybersecurity researchers have uncovered a new phishing campaign involving fake Chrome extensions named Madgicx Plus and SocialMetrics Pro. These malicious extensions are designed to steal Facebook credentials from unsuspecting users by mimicking legitimate marketing tools. Once installed, the extensions intercept login details and send them to threat actors, potentially compromising user accounts and data. The attack highlights the growing trend of cybercriminals exploiting popular digital marketing tools to target social media users. The fake extensions were distributed through deceptive websites and phishing emails, tricking users into installing them under the guise of enhancing their Facebook marketing capabilities. This campaign underscores the importance of verifying the authenticity of browser extensions and being cautious about the sources from which they are downloaded. Users are advised to only install extensions from official stores and to regularly review their browser extensions for any suspicious activity. Security experts recommend enabling multi-factor authentication (MFA) on social media accounts to add an extra layer of protection against credential theft. Additionally, keeping software and browsers updated can help mitigate vulnerabilities exploited by such malicious extensions. Organizations and individuals alike should remain vigilant against these evolving threats by educating themselves on phishing tactics and employing robust cybersecurity practices. Monitoring for unusual account activity and promptly reporting suspicious extensions can help prevent the spread of these credential-stealing tools.

This Cyber News was published on thehackernews.com. Publication date: Fri, 12 Sep 2025 01:14:06 +0000


Cyber News related to Fake Madgicx Plus and SocialMetrics Pro Chrome Extensions Found Stealing Facebook Credentials

Fake Madgicx Plus and SocialMetrics Pro Chrome Extensions Found Stealing Facebook Credentials - Cybersecurity researchers have uncovered a new phishing campaign involving fake Chrome extensions named Madgicx Plus and SocialMetrics Pro. These malicious extensions are designed to steal Facebook credentials from unsuspecting users by mimicking ...
3 months ago Thehackernews.com
Google Takes Down Over 50,000 Instances of Malicious Chrome Extensions - Google recently took down over 50,000 Chrome browser extensions after discovering that they were involved in malicious activity. The malicious activity included advertising click fraud, downloading malware, and displaying adware. According to Google, ...
2 years ago Thehackernews.com
Watch out for "I can't believe he is gone" Facebook phishing posts - This phishing attack is ongoing and widely spread on Facebook through friend's hacked accounts, as the threat actors build a massive army of stolen accounts for use in further scams on the social media platform. As the posts come from your friends' ...
1 year ago Bleepingcomputer.com
Over 6 Million Chrome Extensions Can Execute Remote Commands on Users’ Browsers - A major security incident has come to light involving more than six million installations of Chrome browser extensions that secretly execute remote commands, track user activity, and potentially expose sensitive information. John Tuckner of secure ...
8 months ago Cybersecuritynews.com
Fake VPN Chrome extensions force-installed 1.5 million times - Three malicious Chrome extensions posing as VPN infected were downloaded 1.5 million times, acting as browser hijackers, cashback hack tools, and data stealers. According to ReasonLabs, which discovered the malicious extensions, they are spread via ...
2 years ago Bleepingcomputer.com
How do I block Taylor Swift news from invading my Facebook timeline? - The short answer is that you can't block Taylor Swift from invading your Facebook line. Over the years, Facebook has tested features that allow users to mute certain words from appearing on a user's timeline Feed. In the old days, being able to ...
1 year ago Pandasecurity.com
CVE-2022-47966 - Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, ...
1 year ago
361 million stolen accounts leaked on Telegram added to HIBP - A massive trove of 361 million email addresses from credentials stolen by password-stealing malware, in credential stuffing attacks, and from data breaches was added to the Have I Been Pwned data breach notification service, allowing anyone to check ...
1 year ago Bleepingcomputer.com
Facebook and Instagram passwords were stored in plaintext, Meta fined | Malwarebytes - In 2019, a private security researcher reported finding a database with the names, phone numbers, and unique user IDs of over 267 million Facebook users. Ireland’s privacy watchdog Data Protection Commission (DPC) has fined Meta €91M ($101M) ...
1 year ago Malwarebytes.com
Facebook's New Privacy Nightmare: 'Link History' - Facebook is doubling down on tracking your behavior, despite the efforts of regulators worldwide. Its new Link History app feature is yet another AdTech privacy dark pattern. Meta's Mister Zuckerberg pretends it's all for the good of Facebook users. ...
1 year ago Securityboulevard.com
The zero-day that could've compromised every Cursor and Windsurf user - In a recent post Yomtom explains that while examining the build process behind OpenVSX, the open-source marketplace powering extensions for tools like Cursor, Windsurf, VSCodium, and others, he discovered a critical flaw. Dubbed VSXPloit: A single ...
5 months ago Bleepingcomputer.com
Facebook fake videos - I have spent a not-very-happy time this morning, besieged by Facebook group posts passed off as porn videos and trying to get rid of them. It's unlikely that they're either porn or videos: they're bot postings of malicious links that are probably ...
1 year ago Securityboulevard.com
Facebook Marketplace Is Being Ruined by Zelle Scammers - Some scams encourage people to upgrade their Zelle accounts to a business tier to receive money from a buyer, according to the Better Business Bureau, and come from emails mimicking Zelle, but with different domains. That upgrade appears to cost ...
2 years ago Wired.com
Chrome extensions with 6 million installs have hidden tracking code - While Tuckner didn't catch any extensions stealing user passwords or cookies, the excessively risky capabilities, heavily obfuscated code, and hidden logic were enough for the researcher to label them as risky and, potentially, spyware. A set of 57 ...
8 months ago Bleepingcomputer.com
Google Online Security Blog: Sustaining Digital Certificate Security - The Chrome Security Team prioritizes the security and privacy of Chrome's users, and we are unwilling to compromise on these values. The Chrome Root Program Policy states that CA certificates included in the Chrome Root Store must provide value to ...
1 year ago Security.googleblog.com
Facebook Introduces New Features: Top 20 Most Essential SEO-Optimized Long-Tail Keywords - Facebook recently unveiled several new features to its platform, designed to improve user experience and drive new levels of engagement. Among the new features are advanced personalization options, more powerful security tools, and improved ...
2 years ago Thehackernews.com
Developers Beware of Malicious VS Code Extension Apps With Million of Installations - Cybersecurity researchers have uncovered a disturbing campaign targeting software developers through malicious Visual Studio Code extensions that have collectively amassed millions of installations. These compromised extensions, masquerading as ...
8 months ago Cybersecuritynews.com
State Attorney General Accuses Facebook Of Creating A "Marketplace" For Child Predators - States across the country are currently suing Facebook for endangering young users. According to the lawsuit, the attorney general's office launched an investigation by creating test profiles on Facebook and Instagram that appeared to belong to teen ...
2 years ago Facecrooks.com
Facebook ads push new Ov3r Stealer password-stealing malware - A new password-stealing malware named Ov3r Stealer is spreading through fake job advertisements on Facebook, aiming to steal account credentials and cryptocurrency. The fake job ads are for management positions and lead users to a Discord URL where a ...
1 year ago Bleepingcomputer.com
Malicious Chrome VPN Extensions Installed 1.5M Times Browsers - In a recent cybersecurity revelation, a highly sophisticated cyber attack campaign has emerged, weaving a web of deceit through malicious web extensions cunningly disguised as VPNs. ReasonLabs, a cybersecurity firm, has discovered online piracy ...
1 year ago Cybersecuritynews.com
Malicious Chrome extensions with 1.7M installs found on Web Store - Almost a dozen malicious extensions with 1.7 million downloads in Google's Chrome Web Store could track users, steal browser activity, and redirect to potentially unsafe web addresses. According to the researchers, most of the malicious functionality ...
5 months ago Bleepingcomputer.com
Malicious Chrome extensions with 1.7M installs found on Web Store - Almost a dozen malicious extensions with 1.7 million downloads in Google's Chrome Web Store could track users, steal browser activity, and redirect to potentially unsafe web addresses. According to the researchers, the malicious functionality is ...
5 months ago Bleepingcomputer.com
How to Delete a Facebook Business Page With Our Guide - An inactive Facebook business page won't do your brand any good; sometimes, it may be best to delete it and start fresh. Deleting a page is straightforward and can be undone within 14 days, as here's how you do it. No matter the reason, there may ...
2 years ago Hackercombat.com
Google: Malware abusing API is standard token theft, not an API issue - Google is downplaying reports of malware abusing an undocumented Google Chrome API to generate new authentication cookies when previously stolen ones have expired. In late November 2023, BleepingComputer reported on two information-stealing malware ...
1 year ago Bleepingcomputer.com
Fake browser updates spread updated WarmCookie malware - The latest campaign was discovered by researchers at Gen Threat Labs, who observed the WarmCookie backdoor being distributed as fake Google Chrome, Mozilla Firefox, Microsoft Edge, and Java updates. FakeUpdate is a cyberattack strategy used by a ...
1 year ago Bleepingcomputer.com