Over half a million VKontakte accounts hijacked using malicious Chrome extensions

An on a computer Browsing Google.

---

• Koi Security uncovered malware campaign hijacking 500,000+ VKontakte accounts via Chrome extensions
• Add-ons auto-subscribed victims to attacker’s VK groups (1.4M members), manipulated CSRF tokens, injected ads, and stole payment data
• Campaign ongoing since mid-2025, maintained by threat actor “2vk,” primarily targeting Russian-speaking users