Loading story…
Kaspersky researchers reported that a browser extension presented as an ad blocker was distributed with hidden cryptocurrency-mining functionality. The extension appeared to offer a legitimate privacy and usability feature, but also consumed victim system resources to mine digital currency without clear user awareness or informed consent.
The finding highlights how seemingly benign browser add-ons can act as dual-use malware, blending expected functionality with covert monetization. For defenders, the case underscores the need to scrutinize extension permissions, monitor abnormal browser-driven CPU usage, and restrict unvetted add-ons in enterprise environments to reduce the risk of unauthorized mining and broader browser-based compromise.
Trace attribution and downstream blast radius.
1 event from the most recent confirmed update back to the earliest known activity.
Kaspersky Securelist published research describing an ad blocker that included cryptocurrency-mining functionality. No additional dated milestones are provided in the reference content, so the publication date is used as the event date.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malicious and unwanted browser extensions continued to pose a significant threat to users, including through official browser stores and add-ons disguised as legitimate tools. Kaspersky reported that from January 2020 through June 2022, more than **6 million users** were blocked from downloading malware, adware, or riskware presented as browser extensions, with **adware** making up most detections. The report identified several prominent families, including **WebSearch**, **DealPly-related extensions**, **AddScript**, and **FB Stealer**, each using different delivery and monetization methods. The extensions were distributed through third-party software bundles, malicious updates, and cases where an extension changed hands or a developer account was hijacked after publication. Their activity ranged from affiliate abuse and cookie stuffing to covert script execution and credential theft, with **FB Stealer** highlighted as particularly dangerous because it steals **Facebook session cookies** and enables account hijacking. The findings underscored that browser extensions can become a persistent attack surface even when they appear benign, especially when users grant broad permissions or install unnecessary add-ons.
Aug 15, 2026
The **Razy** malware family was found compromising **Google Chrome, Mozilla Firefox, and Yandex Browser** by disabling extension integrity checks and browser auto-updates, then installing or replacing extensions with malicious versions. In Chrome-based browsers, it could infect existing extensions including the built-in **Chrome Media Router** component; in Firefox, it deployed a fake extension called **"Firefox Protection"**; and in Yandex Browser, it replaced an extension with one masquerading as **Yandex Protect**. The malware’s primary goal was **cryptocurrency theft and fraud**. It replaced wallet addresses and QR codes, altered cryptocurrency exchange pages, injected phishing and scam content, and manipulated **Google** and **Yandex** search results. Supporting scripts including `extab.js` and `bgs.js` injected remote content and sent telemetry through **Firebase**, while remotely loaded `i.js` and `main.js` handled ad injection, page modification, and wallet substitution. The campaign also used phishing domains such as `ton-ico[.]network` and `ooo-ooo[.]info`, and wallets embedded in the analyzed scripts had reportedly received about **0.14 BTC** and **25 ETH**.
Aug 14, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026