“CL Suite” Deception: Malicious Chrome Extension Steals 2FA Secrets and Meta Business Data
Do Son 
A malicious Google Chrome extension posing as a productivity tool for Meta Business Suite has been caught stealing sensitive authentication secrets and corporate data. Socket’s Threat Research Team identified the extension, “CL Suite by @CLMasters,” which advertises itself as a helper for managing Facebook and Instagram business accounts but secretly exfiltrates Two-Factor Authentication (2FA) seeds and internal business intelligence to a threat actor-controlled server.
The extension, which is still live on the Chrome Web Store at the time of writing, represents a significant risk to organizations managing their brand presence on Meta’s platforms.
On the surface, CL Suite offers useful features for social media managers: bulk exporting of user lists, removing annoying verification popups, and generating 2FA codes directly in the browser. However, the convenience comes at a steep price.
Socket’s analysis reveals that the extension’s backend code systematically harvests the very secrets it claims to protect. “In practice, the code transmits TOTP seeds and current one time security codes, Meta Business ‘People’ CSV exports, and Business Manager analytics data to a backend at getauth[.]pro,” the report states.
The malware includes a “failsafe” analytics module that maps out an organization’s entire ad infrastructure, including “billing and payment configuration details (which ad accounts use which funding sources)”. This data gives attackers a blueprint for financial fraud.
The most critical threat posed by CL Suite is its ability to bypass Two-Factor Authentication. By stealing the TOTP seed—the secret key used to generate 2FA codes—the attackers can generate valid login codes indefinitely, effectively turning 2FA off for themselves.
“By stealing TOTP seeds and codes for Facebook and Meta Business accounts, the extension effectively neutralizes 2FA protection and makes full account takeover trivial,” Socket researchers explain.
Once the attackers have the seed, they don’t need the victim’s device anymore. They can simply generate their own codes to access the account, provided they also have the password.
The developers went to great lengths to appear legitimate, publishing a privacy policy that explicitly claims 2FA secrets are stored locally. “The privacy policy claims that 2FA secrets ‘are stored locally in your browser’s storage and are not transmitted to our servers…'” the report notes.
The reality is the exact opposite. Every time a user generates a code or exports a contact list, the data is mirrored to the attacker’s server and, in many cases, forwarded directly to a Telegram channel controlled by the threat actor.
For victims, simply removing the extension isn’t enough. Because the attackers have exfiltrated the 2FA seeds and business data, they retain access even after the software is gone.
“The risk persists even after a victim uninstalls the extension, since the threat actor retains both the 2FA seeds and the exported business intelligence,” the report warns.
Organizations that have installed this extension should consider their Meta Business accounts compromised, revoke all active sessions, reset passwords, and—most importantly—regenerate new 2FA secrets immediately.
Related Posts:
- 184 Million Leaked Credentials Found in Open Database
- Google Play Store Alert: New Phishing Apps Bypass Security, Stealing Crypto Wallet Seeds
- PyPI’s New Rule: 2FA Verification for All Project Maintainers
- Malicious Packages Stealing Crypto Credentials: A Warning for Developers
- Crypto Tax Scam Sweeps Europe: Fake Government Sites Drain Wallets Via Seed Phrase Theft & Malicious Web3
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
