Schedule a Demo

Malicious Chrome Extension Steals Facebook Business Manage 2FA Codes and Analytics Data

February 17, 2026
Malicious Chrome Extension Steals Facebook Business Manage 2FA Codes
Malicious Chrome Extension Steals Facebook Business Manage 2FA Codes

A malicious Chrome extension that claims to help Meta Business users quietly steals Facebook Business Manager 2FA codes and analytics data, putting high‑value ad accounts at risk of takeover.

The extension, “CL Suite by @CLMasters” (ID: jkphinfhmfkckkcnifhjiplhfoiefffl), is still available in the Chrome Web Store and specifically targets Meta Business Suite and Facebook Business Manager environments.

Socket AI Scanner’s analysis of the malicious CL Suite by @CLMasters Chrome extension( source : socket)
Socket AI Scanner’s analysis of the malicious CL Suite by @CLMasters Chrome extension (source: socket)

Marketed as a utility to “extract people data, analyze Business Managers, remove verification popups, and generate 2FA codes,” CL Suite requests broad permissions over meta.com and facebook.com.

Its privacy policy claims that 2FA secrets and Business Manager data remain local in the browser. However, technical analysis shows the extension behaves more like an infostealer than a productivity tool.

Socket’s Threat Researchers found that it systematically abuses the very features it advertises to harvest authentication secrets and business intelligence from authenticated admin sessions.

The most serious issue is how the extension handles two‑factor authentication for Facebook and Meta Business accounts.

Chrome Web Store listing for the CL Suite by @CLMasters extension ( source : socket)
Chrome Web Store listing for the CL Suite by @CLMasters extension ( source : socket)

When users rely on its built‑in 2FA generator, CL Suite captures the TOTP seed, the current 6‑digit 2FA code.

The associated Facebook username and email are then sent to an attacker‑controlled infrastructure at getauth[.]pro, with an option to forward it to a Telegram channel.

With both the seed and a timestamped, valid code, attackers can continue to generate working 2FA codes indefinitely, making it easy to hijack accounts once passwords or recovery channels are obtained from infostealers or credential dumps.

Meta’s official business tools page (source : socket)
Meta’s official business tools page (source: socket)

The extension also aggressively targets Meta Business Manager data.

A “People” extraction feature scrapes the Business Manager “People” view, builds CSV files with names, email addresses, roles, status, and access levels, and silently exfiltrates those CSVs to the same backend, often marked for Telegram forwarding.

Another analytics component enumerates Business Manager IDs, linked ad accounts, connected pages, and billing or payment configurations, giving attackers a complete map of business assets and how ad spend is funded.

Privacy policy page for Meta Business Suite Tools on clmasters[.]pro(source : socket)
Privacy policy page for Meta Business Suite Tools on clmasters[.]pro(source: socket)

Even with a limited install base, this visibility is enough to identify successful targets and plan follow‑on fraud or account‑takeover activity.

According to Socket’s Threat Research, organizations using Meta Business or Facebook Business Manager should audit browser extensions, remove CL Suite, and treat affected accounts as compromised.

Recommended steps include re‑enrolling 2FA with fresh secrets, reviewing Business Manager roles and members, and monitoring for traffic to getauth[.]pro and related infrastructure.

Long-term, enterprises should enforce extension allow‑lists for admin browsers and closely scrutinize any plugin that offers scraping, verification bypass, or in‑browser 2FA generation for high‑value platforms.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

Original article can be found here