Loading story…
A trusted Chrome extension, Save Image as Type, was removed after researchers found it had been hijacked and modified to perform affiliate commission fraud against more than 1 million users. The malicious code reportedly redirected shopping traffic in the background on sites including Amazon, Adidas, and Shein, while the extension continued to function normally, making the abuse difficult for users to notice. Reporting attributes the compromise to a group called Karma, which allegedly acquires established browser extensions from their original developers and then injects malicious code to monetize the existing user base.
Separate research shows how easily this model can work in practice: browser extensions can be sold to new owners, transferring not just code but also user trust and broad permissions. A proof-of-concept described by Annex Security demonstrated that an extension could be purchased cheaply and then repurposed, underscoring the supply-chain risk created when ownership changes are not visible to users. Together, the reporting and research highlight a growing threat in which legitimate extensions become malicious after sale or takeover, allowing attackers to exploit previously trusted add-ons at scale.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Google removed the "Save Image as Type" extension in March 2026 after researchers found it had been hijacked for affiliate commission fraud. Reports said the malicious version may have been active for several weeks before the takedown, and users were advised to uninstall it.
Research by Wladimir Palant connected Karma to a wider pattern of purchasing trusted browser extensions and later inserting malicious payloads. This attribution expanded the story from a single hijacked extension to a broader campaign model.
Annex Security researcher John Tuckner published a proof of concept showing that buying a Chrome extension for about $50 allowed him to push an update to installed users that redirected them to a Rickroll. The demonstration showed how extension ownership transfers can give a new owner automatic control over users' browser behavior through normal update mechanisms.
The Chrome extension QuickLens, which reportedly had about 7,000 users and a Google featured badge, was sold to a new owner and then updated with command-and-control functionality, expanded permissions, and code that weakened browser security protections. The malicious update allegedly used an invisible 1×1 pixel injection technique and stripped protections such as Content Security Policy to enable JavaScript execution on visited pages.
After the acquisition, the extension was modified to silently redirect shopping traffic on sites including Amazon, Adidas, and Shein so the operators could collect affiliate commissions. The extension continued to function normally as an image conversion tool, helping the malicious behavior avoid detection.
The Chrome extension "Save Image as Type," which had more than 1 million users, was reportedly acquired by a group called Karma. The later abuse was tied to this ownership change, illustrating the supply-chain risk of sold browser extensions.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New reporting and research highlighted escalating risk from **Chrome browser extensions** that present as AI productivity or shopping tools while collecting excessive data or performing hidden monetization. An Incogni analysis of 442 “AI-branded” Chrome extensions found **more than half** collected user data and nearly a third collected **personally identifiable information (PII)**, based on requested permissions, developer disclosures, and risk scoring; the study flagged widely used tools as among the most invasive. Separately, Socket researchers identified a Chrome extension marketed as *Amazon Ads Blocker* that silently **hijacked affiliate links**, injecting the developer’s tag `10xprofit-20` into Amazon product URLs and replacing existing creator affiliate codes without user awareness. Socket assessed the affiliate-hijacking behavior as part of a broader, likely coordinated ecosystem: at least **29 related extensions** were observed targeting major e-commerce sites (including Amazon, AliExpress, Best Buy, Shopify, and Shein) using shared infrastructure and repeated policy-violating patterns, indicating intentional abuse rather than accidental noncompliance. In contrast, other contemporaneous items focused on broader consumer privacy guidance (e.g., smart TV tracking mitigations) or regulatory investigations into AI image generation on X/*Grok*; while privacy-adjacent, they do not describe the same **Chrome extension abuse** activity and are not directly actionable for extension-risk response beyond general awareness.
Jun 29, 2026
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026
Researchers identified a campaign involving **19 malicious browser extensions** distributed through the Google Chrome Web Store and Microsoft Edge Add-ons marketplace, with reported installations exceeding **2.3 million users**. Fourteen extensions were published as apparently legitimate software, while five were acquired from their original developers and later updated with malicious functionality, leaving users unaware that ownership and code had changed. The extensions contacted command-and-control infrastructure to retrieve replaceable modules, bypassed Content Security Policy controls, and injected code into targeted web pages. They could steal credentials, payment data, Facebook and LinkedIn information, browsing history, cryptocurrency assets, and hardware-wallet seed phrases; some also overlaid pages with **ClickFix** lures that impersonated browser-update notices and persuaded victims to run malicious commands, potentially extending compromise beyond the browser.
Sep 26, 2026