GhostPoster
GhostPoster is a malicious browser-extension campaign initially identified in Firefox and later linked to Chrome, Microsoft Edge, and Opera extensions. It was first reported by Koi Security and later expanded by LayerX, which linked at least 17 related extensions through shared infrastructure and tactics. Reported install counts range from roughly 50,000 Firefox users in the initial cluster to more than 840,000 downloads across the broader cross-browser campaign, with some extensions active as early as 2020 and remaining undetected for up to five years.
Its defining tradecraft is steganographic payload delivery: the extensions hide JavaScript inside bundled PNG icon files such as logo.png. The extension reads the raw PNG bytes, searches for a marker sequence (reported as 0x3D 0x3D 0x3D / "==="), extracts the concealed JavaScript, and launches a multi-stage infection chain. Additional evasion includes delayed activation ranging from 48 hours to several days, random delays, infrequent payload retrieval, runtime-only decoding, and keeping the final decrypted code only in browser memory. Reported decoding steps include case swapping, swapping digits 8 and 9, Base64 decoding, and XOR decryption derived from the extension runtime ID.
Observed capabilities include remote command execution in the browser context, affiliate-link hijacking, forced redirects to e-commerce sites for affiliate fraud, click/ad fraud, injection of tracking or Google Analytics scripts, browser activity monitoring, weakening or stripping HTTP security headers including Content-Security-Policy, bypassing CAPTCHA protections, and injecting hidden iframes/backdoors. Reporting also states the malware can steal credentials and personal data, though one source specifically noted no password harvesting or phishing-page redirection in the analyzed Firefox sample. Named infrastructure includes liveupdt.com, with additional domains such as dealctr.com, mitarchive.info, and gmzdaily.com reported in related extensions.
The campaign has been linked in reporting to a broader Chinese-linked operation tracked as DarkSpectre, which researchers describe as a long-running, well-funded browser-extension threat actor. GhostPoster has targeted users through official extension marketplaces using legitimate-looking extension themes such as VPN, translation, ad-blocking, weather, and download tools; cited examples include Free VPN Forever, Google Translate in Right Click, Youtube Download, Ads Block Ultimate, and an Opera add-on named Google™ Translate. Mozilla and Microsoft reportedly removed identified extensions from their stores, but already-installed extensions require manual removal.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“LayerX said it found a new cluster of 17 extensions related to GhostPoster impacting Google Chrome and Microsoft Edge.”
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence
1 technique
Persistence
Stealth
1 technique
Stealth
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious Firefox extension campaign using steganography in a PNG icon to deliver payloads and evade review/static analysis; associated extensions reached ~840k downloads and persisted up to 5 years.
Malicious browser-extension cluster used to hijack affiliate links, inject tracking code, and conduct click/ad fraud across major browsers.
A malicious browser-extension campaign distributing trojanized extensions via official browser stores. Uses steganography to hide payloads in PNG files, delays execution to evade review/scanning, contacts attacker-controlled servers to fetch additional scripts, and performs credential/personal-data theft, affiliate-link hijacking, tracking-script injection, and HTTP header manipulation to weaken security protections.
A malicious browser extension campaign that concealed malicious code inside seemingly benign PNG image files to evade detection, leveraging shared backend infrastructure across multiple add-ons and focusing on stealth/persistence across Edge, then Chrome and Firefox.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.