131 CHROME EXTENSIONS CAUGHT HIJACKING WHATSAPP WEB FOR MASSIVE SPAM CAMPAIGN

Summary from the TLDR InfoSec newsletter

Socket researchers discovered 131 malicious Chrome extensions with over 20,000 active users that inject code into WhatsApp Web to automate bulk spam campaigns targeting Brazilian users. The extensions, marketed as CRM tools with names like “YouSeller” and “ZapVende,” share identical codebases and are distributed through a franchise model operated by DBX Tecnologia, violating Google's Chrome Web Store policies. The nine-month campaign aims to bypass WhatsApp's rate limits and anti-spam controls by automating message sending without user confirmation.