A fake Google Translate extension that hides its actions in the browser windows you aren’t watching

VMRay Labs Note. By Emre Güler, VMRay Labs. 10.08.2026.

Key finding. VMRay Labs analyzed a malicious Chrome extension, dropped alongside the Stealc infostealer by a loader likely written in Rust, that impersonates Google Translate and turns the victim's own browser into a remote-controlled tool for the attacker. Its most notable trait: to keep its activity out of sight, the extension can drive Chrome windows that are out of focus in the background, so the remote clicks and keystrokes happen where the victim is not looking. It can also overlay a real login page with a phishing form while leaving the legitimate domain in the address bar, defeating the usual advice to check the URL.

What was observed

The chain runs in stages. A Rust binary drops a malicious Chrome extension and an AutoIt script, and the AutoIt script in turn drops Stealc v2, a commodity infostealer. The extension presents itself as Google Translate.

Once installed, it behaves as a full data-theft and remote-control tool. It extracts browser history, bookmarks, the list of installed extensions, saved credentials, and cookies. Beyond theft, it gives the operator live control: a stream of the victim's Chrome windows, the ability to interact with sites through remote mouse clicks and keyboard input, a proxy setting, and the injection of malicious JavaScript into specific sites.

Two capabilities stand out. First, the remote control extends to out-of-focus windows, so an attacker can act in a background tab the victim is not viewing, keeping the manipulation hidden. Second, the extension can perform a man-in-the-browser attack: it replaces a legitimate login form with an iframe that loads from a phishing page, while the address bar still shows the genuine domain. To the victim, nothing looks wrong.

Why it matters

Both techniques attack the assumptions defenders and users rely on. "Check the domain in the address bar" fails when the domain is real and the content beneath it is not. And watching the active window fails when the malicious actions are deliberately routed to a window that is not in focus. Behavioral analysis catches this because the remote-control traffic, the injected iframe, and the background-window manipulation all occur during execution, regardless of how convincing the surface looks.

FAQ

What is a man-in-the-browser attack? An attack in which malware manipulates what happens inside the victim's own browser session, so a page can display the correct domain while its contents are controlled by the attacker.

What is Stealc? A commodity infostealer sold as a service that harvests credentials, cookies, and other sensitive data from the browser. This chain drops Stealc version 2.

Why does controlling out-of-focus windows matter? It lets the attacker perform actions in a browser window the victim is not currently viewing, so the remote clicks and typing stay hidden from view.

Indicators of compromise

The full analysis is available in the linked report: https://www.vmray.com/analyses/chrome-extension-controls-out-of-focus-browser-windows/report/overview.html