Loading story…
Microsoft has removed 119 malicious extensions from the official Edge Add-ons store and suspended more than 90 developer accounts linked to a coordinated operation it calls StegoAd. The campaign, active since at least 2021, used browser add-ons that initially appeared legitimate before delivering malicious payloads three to five days after installation. Microsoft said the operation also extended to Chrome and Firefox, adapted successfully from Manifest V2 to Manifest V3, and may have reached as many as 2.6 million installs.
The actor hid malicious JavaScript inside PNG, WebP, and WOFF2 files using steganography, while relying on dormancy, fingerprinting, DevTools detection, selective payload delivery, and resilient infrastructure to evade scrutiny. Retrieved payloads enabled arbitrary JavaScript execution, theft of Google credentials and second-factor codes, harvesting of WordPress admin logins, bulk cookie exfiltration for session hijacking, and advertising/search affiliate fraud. Microsoft also identified more than 10 command-and-control domains, failover mechanisms, and supporting infrastructure that included Cloudflare Workers, GitHub Pages, and covert telemetry through Google Analytics tracking IDs, and advised affected users to treat their browsers as exposed and rotate sensitive credentials.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
Security Affairs reported that Koi Security linked the credential-exfiltration domain mitarchive.info used in the StegoAd campaign to the Chinese operation DarkSpectre, previously associated with ShadyPanda and GhostPoster. This introduced a new attribution detail beyond Microsoft's original disclosure.
Microsoft publicly described StegoAd as a sophisticated operation that used steganography, dormancy, fingerprinting, and selective payload delivery to evade detection. It said the extensions may have reached up to 2.6 million installs and advised affected users to treat their browsers as exposed and rotate sensitive credentials.
Microsoft identified a coordinated campaign it calls StegoAd and removed 119 malicious extensions from the official Edge Add-ons store. The company also linked more than 90 developer accounts to the operation and suspended those accounts.
Microsoft said the threat actor behind the StegoAd operation has been active since at least 2021, running a coordinated malicious browser extension campaign across browser ecosystems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
6 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcescworld.com
Open sourcemalwarebytes.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcenews.risky.biz
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a campaign involving **19 malicious browser extensions** distributed through the Google Chrome Web Store and Microsoft Edge Add-ons marketplace, with reported installations exceeding **2.3 million users**. Fourteen extensions were published as apparently legitimate software, while five were acquired from their original developers and later updated with malicious functionality, leaving users unaware that ownership and code had changed. The extensions contacted command-and-control infrastructure to retrieve replaceable modules, bypassed Content Security Policy controls, and injected code into targeted web pages. They could steal credentials, payment data, Facebook and LinkedIn information, browsing history, cryptocurrency assets, and hardware-wallet seed phrases; some also overlaid pages with **ClickFix** lures that impersonated browser-update notices and persuaded victims to run malicious commands, potentially extending compromise beyond the browser.
Sep 26, 2026
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026
A widespread malware campaign has leveraged browser extensions to infect millions of users, primarily through Chrome and Edge platforms. The operation, identified as "ShadyPanda," involved at least 145 malicious extensions, some of which initially appeared legitimate but were later updated to include spyware and remote code execution capabilities. These extensions engaged in affiliate fraud, search hijacking, and exfiltration of sensitive user data, with some remaining active on the Microsoft Edge Add-ons platform despite removal from the Chrome Web Store. Attackers manipulated installation counts to boost the perceived legitimacy of their extensions, making them more likely to be trusted and installed by users. Similar tactics have been observed in other campaigns, such as the resurgence of "Glassworm," which targets popular developer tool extensions by cloning them, inflating download statistics, and later updating them with malicious code. Attackers exploit the trust users place in well-known extensions and the difficulty in distinguishing between legitimate and malicious versions, especially within code editor marketplaces. These evolving threats highlight the ongoing risks posed by browser and code editor extensions, particularly as attackers refine their methods to evade detection and maximize impact.
Jun 29, 2026