Once installed, the extension requires extensive permissions to capture and manipulate internet users’ online activities. And almost everything goes there: Facebook cookies, including c_user containing the user identifier, IP address, geolocation, personal account-related information (username and username), credit card information, and billing related to ad accounts. Everything is sent to a Google script URL that acts as a command and control (C2) server.