Software Access

Software Access is a malicious Google Chrome extension identified by Socket as part of a coordinated campaign involving five malicious extensions targeting customers of Workday, NetSuite, and SAP SuccessFactors. Published under the name Software Access, it masqueraded as a productivity or access tool for enterprise HR/ERP platforms. Its core capability is theft of authentication cookies/tokens and session hijacking. Unlike the other related extensions, Software Access also supports bidirectional cookie injection: it can receive stolen cookies from attacker-controlled infrastructure at api.software-access[.]com, remove existing cookies for a target domain, and inject attacker-provided cookies into the browser using chrome.cookies.set(), enabling direct session relay and authenticated account takeover. The reported behavior can bypass MFA because valid session tokens are implanted directly rather than requiring credentials. Socket also reported anti-analysis functionality in Software Access through use of the DisableDevtool library to hinder browser code inspection. Across the broader campaign, the extensions shared similar API structures, monitored for the same list of 23 security-related Chrome extensions, and were assessed as likely operated by the same threat actor. The campaign collectively reached roughly 2,300 installs before removal from the Chrome Web Store. High-confidence associated indicators include the extension ID bmodapcihjhklpogdpblefpepjolaoij and the C2 domain/api endpoint software-access[.]com / api.software-access[.]com.