---
title: Five Malicious Chrome Extensions Target Enterprise HR and Financial Systems
description: Five Chrome extensions attack platforms like Workday, stealing tokens and hijacking sessions, affecting 2,300 users with cookie injection.
canonical_url: https://codekeeper.co/ticker/chrome-extensions-attack-enterprise-platforms
---

# Five Malicious Chrome Extensions Target Enterprise HR and Financial Systems

Five Chrome extensions attack platforms like Workday, stealing tokens and hijacking sessions, affecting 2,300 users with cookie injection.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jan 20, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Five coordinated Chrome extensions are attacking major enterprise platforms like Workday, NetSuite, and SuccessFactors, affecting over 2,300 users. Published under names "databycloud1104" and "softwareaccess," these fake productivity tools steal authentication tokens and hijack user sessions. The most dangerous feature involves bidirectional cookie injection, letting attackers access victim accounts without passwords or bypassing multi-factor authentication. The extensions extract session tokens every 60 seconds and block up to 56 administrative pages, preventing security teams from resetting passwords or disabling compromised accounts. When administrators try to respond, the extensions replace security pages with blank content, creating a scenario where breaches are detected but can't be stopped through normal procedures. **Source:** [Cybersecurity News](https://cybersecuritynews.com/5-malicious-chrome-extensions-attacking-enterprise-hr/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchrome-extensions-attack-enterprise-platforms%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Magento Zero-Day Under Attack, No Adobe Fix in Sight Sep 7, 2026](https://codekeeper.co/ticker/stylesmuggler-zero-day-magento-vulnerability)

[CISA Flags Actively Exploited Linux Kernel Vulnerability Aug 12, 2026](https://codekeeper.co/ticker/cisa-adds-cve-2022-0492-to-vulnerability-catalog)

[Microsoft Flagged a Perfect-10 Entra ID Flaw as Exploited, Then Withdrew the Claim Aug 31, 2026](https://codekeeper.co/ticker/entra-id-critical-flaw-remote-code-execution)

[Ransomware New 'SynkLoader' Malware Could Be Paving the Way for Ransomware Attacks Aug 25, 2026](https://codekeeper.co/ticker/synkloader-malware-phishlocker-sso-breach)