A Russian Malware Toolkit Is Selling Guaranteed Chrome Web Store Access for Phishing Attacks

Browser extensions were once treated as a mild nuisance in the security threat model. That era is over.

Over the past few months, browser based attacks have accelerated in scale and ambition, shifting from opportunistic scams to coordinated campaigns that quietly compromise millions of users. In December 2025, a set of linked extension driven attacks exposed gaps across Chrome, Edge, and Firefox, ultimately impacting nearly nine million users. Weeks later, researchers uncovered extensions harvesting private conversations from popular AI tools, including one carrying a Google Featured badge. Another campaign followed, deliberately crashing browsers to trick victims into installing remote access malware under the guise of a fix.

Now Varonis researchers are tracking a new entry that pushes the model further toward industrialization: a malware as a service toolkit sold openly on a Russian language cybercrime forum. The seller calls it Stanley.

For a price ranging from $2,000 to $6,000, Stanley offers buyers a turnkey browser based credential theft operation disguised as a legitimate Chrome extension. The most expensive tier comes with a promise that fundamentally alters the risk calculus for criminals: guaranteed publication on the Chrome Web Store.

That guarantee is the product’s real innovation. Distribution has always been the hardest part of browser based attacks. Stanley shifts that burden away from buyers entirely, suggesting the seller has a repeatable method for clearing Google’s extension review process. Researchers reported the infrastructure behind the toolkit to Google and the hosting provider on January 21, 2026. The command and control server was taken offline the following day, but the extension itself remained live.

Stanley is marketed as a packaged service rather than a bespoke build. The original forum listing appeared on January 12 and included a feature breakdown and demo video showing live spoofing attacks against major cryptocurrency exchanges. The seller, using the alias “Стэнли,” positioned the toolkit as plug and play, complete with a management panel and customization options.

Under the hood, the extension presents itself to users as a simple note taking and bookmarking tool called Notely. That cover is deliberate. The extension does function as advertised, allowing users to save notes and bookmarks while browsing. That legitimate utility provides justification for the broad permissions it requests and helps the extension collect positive reviews before any malicious activity begins.

Those permissions grant the extension access to every website a user visits, along with the ability to inject scripts at page load. The malicious code executes before the legitimate content appears, giving the attacker full control over what the victim sees.

Stanley’s management panel, shown in the seller’s demo video, looks more like enterprise software than crimeware. Infected users are tracked by IP address rather than a random identifier, allowing operators to correlate activity across sessions and target specific regions. From the panel, an attacker can assign hijacking rules to individual victims, choosing which legitimate URL to intercept and which phishing page to display instead.

When a target visits a hijacked site, the extension prevents navigation and overlays a fullscreen iframe controlled by the attacker. The browser’s address bar continues to display the real domain, while the content shown is entirely fake. Even experienced users are unlikely to spot the difference.

The toolkit goes further by enabling real time push notifications delivered directly through the browser. Because these alerts originate from Chrome itself rather than a website, they carry an added layer of trust. Operators can customize the message and link it to any redirect, actively pulling victims into phishing flows on demand.

Technically, Stanley is not especially sophisticated. Its code contains Russian language comments, inconsistent error handling, and empty exception blocks. The techniques it uses are well known and widely documented. The price tag reflects something else entirely: access and persistence. The promise of Chrome Web Store approval, combined with backup domain rotation that keeps the malware alive even after takedowns, is what makes the toolkit dangerous.

That reality breaks much of the standard consumer security advice. Installing extensions only from official stores, checking reviews, or trusting verified badges offers little protection when malicious tools can pass moderation and remain published for months. Once installed, they can silently harvest credentials at scale.

For enterprises, the most effective response is restrictive by design. Browser management tools that block all extensions except those explicitly approved significantly reduce exposure, though they require ongoing maintenance and review. For individual users, minimizing the number of installed extensions and regularly auditing permissions remains one of the few practical defenses.

The broader issue is structural. Browser extension marketplaces operate on a review once, update anytime model. An extension can pass scrutiny as a benign tool and later introduce malicious functionality through updates. Until that model changes, toolkits like Stanley will continue to surface.

According to Varonis research author Daniel Kelley:

"Extensions that do something useful while hiding malicious functionality are hard to spot. They pass store reviews, they work as advertised, and users have no reason to question them. The permissions needed for legitimate features are often the same ones needed to steal credentials or hijack sessions. Only install extensions you actually need, and regularly audit your browser to remove any you're no longer using."

As workforces rely more heavily on browsers for access to SaaS platforms, internal tools, and sensitive data, attackers are treating the browser itself as the endpoint. Stanley is not an outlier. It is a sign that browser based attacks have matured into a commercial ecosystem, one where access to trusted distribution channels is now the most valuable commodity of all.