OffiDocs Chrome Extensions With 2.3 Million Installs Caught Harvesting Browsing URLs
Do Son 
Image Downloader Professional Premium
Bay Area Labs has linked 60 Chrome extensions with 2.3 million installs to a single Estonian company. According to its report, the OffiDocs Chrome extensions include office editors, PDF tools and a free VPN. Furthermore, 37 of them “hex-encode/obfuscate and exfiltrate full URLs” that users visit.
A Sprawling Extension Network
The extensions sit under four publisher accounts: officeonlinesystems, RedcoolMedia, ApkOnline android online and RunApps. Beyond Chrome, the researchers found 51 more add-ons on Firefox and a handful on Edge and China’s 360 store.
Most look like ordinary office tools. They include Word, Excel, PowerPoint and PDF editors, plus a Linux server console. Several carry Google’s “Featured” badge. For example, “XLS Editor” has 80,000 users, and “LibreOffice Editor” has 50,000.
Not the First Warning
OffiDocs is not new to this. Earlier in 2026, researcher Q Continuum named it among the actors behind 287 spying Chrome extensions with 37 million installs. Bay Area Labs says the OffiDocs “extension empire is growing, with many extensions targeted at businesses.”
How the URL Harvesting Works
Each extension creates a unique user ID at install. It then hex-encodes the URL of each page you visit and sends it, with that ID, to OffiDocs-linked servers. The hex step matters. In the researchers’ view, Chrome Web Store review “doesn’t flag hex-encoded URLs,” and many DLP tools miss it too.
Server-Controlled Tab Redirects
The server reply can also take over your tab. If it contains “302,” the extension swaps the page you were on for one of its own pages. “The server decides, per user and per URL, when that happens,” the report notes.
Weak or Missing Disclosure
Some extensions show a popup disclaimer. However, the researchers argue a notice “is not the same as explicit consent.” Meanwhile, the privacy policies allow sharing data with “service providers, affiliates, agents, business partners, and other third parties.”
RunApps fares worst. Its “Image Downloader Professional Premium” gives no notice that it collects every URL. Its privacy policy, the report says, “has no mention of passively collecting every URL a user visits.”
So where does the data go? Nobody knows for sure. The OffiDocs terms reference the Bright SDK from Bright Data, so the researchers suspect a link. Still, they found no Bright SDK code inside the extensions themselves.
A Free VPN That Watches You
The researchers single out “VPNOnline,” which has 20,000 users. Every hour, it downloads a keyword list from onworks.net. It then reports any visited URL that contains a keyword.
At present, the list mostly targets downloads. Yet the keyword “ama” matches every amazon.com page. Worse, the operators can change the list “at any time without pushing an update through Chrome Web Store review.”
The privacy promise also falls apart. VPNOnline routes traffic through eight plain HTTP proxies, and every user shares the same published login. As a result, anyone on your network can see which sites you visit.
Tying It Back to OffiDocs
To link the accounts, the researchers matched shared code, contact details and server endpoints. They also found a VAT number registered to OffiDocs Group OU, the same registry-code typo, and shared mail servers. In addition, none of the publishers registered as “traders” on the Chrome Web Store.
Why It Matters
Full URLs often carry far more than a web address. “Legacy OAuth flows can leak tokens, magic sign-in links, sensitive DocuSign documents,” the report warns. In the wrong hands, that data could reach “a data broker, a competitor or a state actor.”
What Users Should Do
- Check your browser for OffiDocs Chrome extensions from the four named publishers and remove them.
- Avoid free VPN extensions that cannot explain how they handle traffic.
- Sign out of active sessions and reset passwords for sensitive accounts you used while the extensions were installed.
- For businesses, audit installed extensions and enforce an allowlist.
OffiDocs and Google had not publicly responded at the time of writing.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
