Loading story…
A malicious campaign known as GhostPoster has been discovered leveraging the logo files of 17 Mozilla Firefox browser add-ons to conceal JavaScript code that enables a range of fraudulent activities. These extensions, which were collectively downloaded over 50,000 times, posed as legitimate tools such as VPNs, ad blockers, screenshot utilities, and translation services. Security researchers from Koi Security found that the malicious code was hidden within the image files using steganography, allowing it to evade detection. Once activated, the code would hijack affiliate links, inject tracking scripts, and facilitate click and ad fraud, while also stripping away browser security protections and opening a backdoor for remote code execution.
The attack chain is initiated when the extension loads and fetches its logo file, which is parsed for a specific marker to extract the embedded JavaScript loader. This loader then attempts to retrieve the main malware payload from attacker-controlled domains, but only does so 10% of the time and with a 48-hour delay between attempts, making detection more difficult. The extensions have since been removed from the Firefox add-on store, but the campaign highlights the risks of malicious browser extensions and the sophisticated evasion techniques employed by threat actors. All identified extensions communicated with the same malicious infrastructure, and not all used identical payload delivery methods, but they shared the same core behaviors and objectives.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
Following disclosure, the malicious extensions were removed from Firefox in at least some cases, though reporting indicated that many were still available on the Firefox Add-Ons page at the time of publication. Users were advised to uninstall affected add-ons and reset important account passwords.
Koi Security reported that 17 Firefox extensions were involved in the GhostPoster operation and published technical details on the malware's steganographic delivery and evasion methods. The researchers assessed the infrastructure and behavior as likely tied to a single threat actor or group.
The compromised Firefox add-ons were downloaded over 50,000 times, exposing a large number of users to affiliate link hijacking, ad and click fraud, and browser monitoring. The campaign used delayed and probabilistic payload delivery to reduce the chance of detection.
A threat actor deployed the GhostPoster campaign through 17 malicious Firefox extensions disguised as VPNs, ad blockers, and translation tools. The add-ons used steganography to hide JavaScript in logo images and established persistent, high-privilege browser access for fraud, tracking, and potential remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026
Multiple active **social-engineering-driven malware operations** are targeting end users through trusted distribution channels. One campaign, dubbed **GhostPoster**, distributed **17 malicious browser extensions** across *Chrome, Firefox, and Edge* with **840,000+ installs**, using legitimate-sounding names (e.g., “Google Translate in Right Click,” “Youtube Download,” “Ads Block Ultimate”) and evading store reviews for years. The extensions used **steganography** to hide code in PNGs, then extracted payloads to contact attacker infrastructure, enabling credential/data theft, tracking, affiliate-link hijacking, script injection, and HTTP header manipulation to weaken protections. Separately, threat actors are impersonating **Malwarebytes** via trojanized ZIP “installers” (e.g., `malwarebytes-windows-github-io-X.X.X.zip`) and using **DLL sideloading**—pairing a legitimate EXE with a malicious `CoreMessaging.dll`—to execute **infostealers**; reporting highlighted a campaign fingerprint via **behash** `4acaac53c8340a8c236c91e68244e6cb` and distinctive DLL strings used for infrastructure mapping. A different operation identified by CloudSEK involves **“RedLineCyber”** masquerading as an affiliate of “RedLine Solutions” to build credibility inside private **Discord** communities and deliver a Python-based **clipboard hijacker** (often `Pro.exe` / `peeek.exe`) aimed at **cryptocurrency wallet theft**, relying on long-term grooming of high-value targets rather than broad phishing.
Jun 29, 2026
A widespread malware campaign has leveraged browser extensions to infect millions of users, primarily through Chrome and Edge platforms. The operation, identified as "ShadyPanda," involved at least 145 malicious extensions, some of which initially appeared legitimate but were later updated to include spyware and remote code execution capabilities. These extensions engaged in affiliate fraud, search hijacking, and exfiltration of sensitive user data, with some remaining active on the Microsoft Edge Add-ons platform despite removal from the Chrome Web Store. Attackers manipulated installation counts to boost the perceived legitimacy of their extensions, making them more likely to be trusted and installed by users. Similar tactics have been observed in other campaigns, such as the resurgence of "Glassworm," which targets popular developer tool extensions by cloning them, inflating download statistics, and later updating them with malicious code. Attackers exploit the trust users place in well-known extensions and the difficulty in distinguishing between legitimate and malicious versions, especially within code editor marketplaces. These evolving threats highlight the ongoing risks posed by browser and code editor extensions, particularly as attackers refine their methods to evade detection and maximize impact.
Jun 29, 2026