StealTok: 130k Users Compromised by Data Stealing TikTok Video “Downloaders”

A large-scale campaign involving at least 12 browser extensions masquerading as TikTok video downloaders has been identified across the Chrome and Microsoft Edge marketplaces. While these extensions provide the advertised functionality (downloading TikTok videos, often without watermarks), they simultaneously implement covert tracking, remote configuration capabilities, and data collection mechanisms.

The campaign has impacted over 130,000 users, with approximately 12,500 active installations at the time of analysis. All samples belong to a single code family, indicating a coordinated operation leveraging cloned, rebranded, and slightly modified extensions to maximize reach and persistence.

Beyond privacy concerns, the use of remote configuration endpoints introduces a significant security risk, enabling post-installation behavior changes that bypass marketplace review mechanisms.

Key Takeaways

• A single actor operated 12+ extensions with a shared codebase
• Over 130K users impacted, ~12.5K still active
• Extensions used remote configuration to bypass store review
• Collected high-entropy fingerprinting data (including battery status)
• Many were featured in official stores, increasing trust and reach

This campaign thrives on repetition and variation.

Instead of building new tools from scratch, the operator maintains a core extension architecture and spins off multiple versions:

• Some are nearly identical clones
• Others are lightly rebranded
• A few introduce incremental changes or new infrastructure

From the outside, these appear as separate products: TikTok Video Downloader,””Mass TikTok Downloader,””No Watermark Saver.” Under the hood, they are the same.

Notably, many of these extensions carried a “Featured” badge in the store, an indicator typically associated with vetted, high-quality extensions, significantly increasing user trust and adoption despite the underlying risks.

This creates a resilient ecosystem. When one extension is flagged or removed, others remain active. New ones can be uploaded quickly, often with the same screenshots, descriptions, and functionality.

The result is a continuous cycle:

1. Upload clean or minimally suspicious extension
2. Gain users and trust
3. Introduce additional capabilities via updates
4. Get partially removed or flagged
5. Reappear under new identities

This is not just a malware campaign – it’s an operational model, where persistence is achieved through duplication, rebranding, and rapid redeployment.

All extensions share a consistent Manifest V3 (MV3) architecture, with almost identical permissions and host permissions. Notably, many of these extensions carried a “Featured” badge in the store. This designation is typically associated with vetted, high-quality extensions, and is prominently displayed to users as a mark of trust. As a result, it significantly lowers user suspicion and increases installation likelihood, even when the underlying extension shares code and behavior with less visible variants.

They also had similar screenshots uploaded to the extension’s store page.

A defining characteristic of this campaign is its reliance on external configuration servers. Rather than hardcoding behavior, several variants fetch JSON configuration files from attacker-controlled domains:

• https://user.trafficreqort.com/data.json
• https://report.browsercheckdata.com/info.json
• https://check.qippin.com/config.json
• https://help.virtualbrowserer.com/rest.json

Some of these domains exhibit clear signs of deception, including typosquatting patterns such as “trafficreqort” instead of “trafficreport” or “tiktak” instead of “tiktok.” These subtle inconsistencies are often used to evade casual inspection while maintaining plausible legitimacy.

While no direct attribution can be made, the consistency in code, infrastructure patterns, and operational behavior strongly indicates a single actor or a tightly coordinated group.

This campaign exemplifies a broader shift in how browser extensions can be abused. Rather than deploying overtly malicious code, the operator leverages legitimate functionality as a delivery mechanism for long-term access and control.

The real risk lies not in what the extensions do today, but in what they are capable of doing tomorrow. Remote configuration transforms them into adaptable tools that can evolve after installation, while their access to authenticated sessions and browsing context makes them particularly valuable for data collection and potential exploitation.

Even in their current state, these extensions enable detailed user profiling. They collect information about usage patterns, downloaded content, device characteristics, and environmental data such as timezone and language. Combined, this creates a fingerprint that can be used to track users across sessions and potentially across services.

In a worst-case scenario, the same mechanisms could be repurposed for broader data exfiltration, abuse of authenticated requests, or integration into larger proxy or botnet-like infrastructures.

What makes this campaign particularly difficult to detect is its operational model:

• Initial versions are clean or minimally suspicious
• Behavior is deferred and remotely controlled
• Each extension appears as an independent product
• Store trust signals (such as “Featured” badges) reduce user scrutiny

This highlights a fundamental gap in current defenses: most security tools focus on installation-time validation, while the real risk emerges at runtime.

Addressing this requires a shift toward continuous, behavior-based monitoring of browser extensions capabilities that can detect changes in network activity, DOM interaction, and permission usage after installation. LayerX’s latest technology is designed to close this gap by providing real-time visibility and enforcement at the browser level, enabling organizations to identify and block malicious extension behavior even when it originates from seemingly legitimate or previously trusted extensions.

In this model, the browser extension is no longer a static tool,it is a living foothold, controlled remotely and evolving over time.

Security professionals, enterprise defenders, and browser developers should take the following actions:

• Audit extensions within managed environments, especially those installed outside of policy controls.
• Adopt runtime monitoring approaches that focus on extension behavior after installation, rather than relying solely on marketplace validation.
• Deploy behavior-based extension monitoring technologies to detect unauthorized network activity or suspicious DOM manipulation.
• Strengthen runtime monitoring and enforcement, not just install-time review, to detect post-installation behavior changes driven by backend infrastructure.