Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts

In a concerning development for businesses and individuals relying on Workday and NetSuite platforms, cybersecurity researchers have uncovered five malicious Google Chrome extensions that mimic these HR and ERP solutions to infiltrate user accounts.

The Extensions' Modus Operandi

These extensions work together to steal authentication tokens, impede incident response capabilities, and facilitate complete account takeover through session hijacking. Kush Pandyas, a researcher at Socket security, revealed these details in a report published on January 16, 2026.

The Extensions and Their Functionality

• DataByCloud Access: With over 1,000 installs, this extension collects authentication cookies for specified domains and transmits them to the "api.databycloud[.]com" domain every 60 seconds.
• Tool Access 11: This extension blocks access to 44 administrative pages within Workday by erasing page content and redirecting to malformed URLs.
• DataByCloud 1: This extension replicates the cookie-stealing functionality from DataByCloud Access while preventing code inspection using web browser developer tools.
• DataByCloud 2: This extension expands the blocking feature to 56 pages, targeting both production environments and Workday's sandbox testing environment.
• Software Access: The most sophisticated extension combines cookie theft with the ability to receive stolen cookies and inject them into the browser for direct session hijacking.

Implications for North East India and Beyond

While this threat primarily affects Workday and NetSuite users globally, including those in North East India, it underscores the growing need for vigilance and awareness about cybersecurity threats. As more businesses in the region embrace digital transformation, they become increasingly vulnerable to such attacks.

Protecting Yourself from These Threats

If you have installed any of the aforementioned add-ons, it is advisable to remove them from your browser, perform password resets, and review for any signs of unauthorized access from unfamiliar IP addresses or devices.

Looking Ahead

The combination of continuous credential theft, administrative interface blocking, and session hijacking creates a scenario where security teams can detect unauthorized access but cannot remediate through normal channels. As such, it is crucial for users and businesses to stay informed about the latest cybersecurity threats and take proactive measures to protect their digital assets.