Loading story…
Malicious and unwanted browser extensions continued to pose a significant threat to users, including through official browser stores and add-ons disguised as legitimate tools. Kaspersky reported that from January 2020 through June 2022, more than 6 million users were blocked from downloading malware, adware, or riskware presented as browser extensions, with adware making up most detections. The report identified several prominent families, including WebSearch, DealPly-related extensions, AddScript, and FB Stealer, each using different delivery and monetization methods.
The extensions were distributed through third-party software bundles, malicious updates, and cases where an extension changed hands or a developer account was hijacked after publication. Their activity ranged from affiliate abuse and cookie stuffing to covert script execution and credential theft, with FB Stealer highlighted as particularly dangerous because it steals Facebook session cookies and enables account hijacking. The findings underscored that browser extensions can become a persistent attack surface even when they appear benign, especially when users grant broad permissions or install unnecessary add-ons.
Trace attribution and downstream blast radius.
11 events from the most recent confirmed update back to the earliest known activity.
Imperva Research Labs uncovered an ad-injection campaign tied to the AllBlock browser extension for Chrome and Opera, which injected malicious code into tabs and hijacked clicks to affiliate URLs. Imperva also linked the infrastructure to an older PBot campaign and published related indicators of compromise.
In 2021, 1,823,263 unique users attempted to download malicious or unwanted browser extensions. The figure showed the threat remained widespread after the 2020 peak.
The number of unique users affected by malicious or unwanted browser extensions peaked in 2020 at 3,660,236, according to Kaspersky telemetry. This marked the highest annual impact level in the period discussed.
In 2020, Google removed 106 malicious browser extensions from the Chrome Web Store. Before removal, they had been downloaded 32 million times and were used to steal cookies and passwords and take screenshots across more than 100 abused networks.
The AddScript browser-extension threat family was first seen in early 2019. The report notes it was still active in 2022.
Early variants of the DealPly-related adware browser extensions appeared in late 2018. These extensions were associated with adware that modified browser settings and redirected users to affiliate sites.
From January 2020 through June 2022, Kaspersky products prevented 6,057,308 users from downloading malware, adware, and riskware disguised as browser extensions. Over the same period, adware accounted for about 70 percent of affected users, with more than 4.3 million attacked by adware and more than 2.6 million by malware.
Between January and June 2022, 97,515 unique Kaspersky users encountered DealPly-related extensions. These were typically installed by the DealPly adware executable rather than directly by users.
In the first half of 2022, 156,698 unique users encountered the AddScript browser-extension threat family. The report identifies it as an active threat family first seen in 2019.
In the first half of 2022, WebSearch was the most common browser-extension threat in Kaspersky telemetry, affecting 876,924 unique users. The adware commonly masqueraded as document-related tools and changed browser settings to collect queries and promote affiliate links.
A malicious Google Chrome extension available in the official store was found capable of recognizing and stealing payment card details entered into web forms. Google removed the extension after it had already infected more than 400 users.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026
Security researchers reported multiple **malicious browser extension** operations abusing official add-on stores. Socket identified five Chrome Web Store extensions impersonating productivity/security tools for **Workday, NetSuite, and SAP SuccessFactors**, installed over 2,300 times, that performed credential theft and session abuse via **cookie exfiltration**, **cookie injection for session hijacking**, and **DOM manipulation** to block security/incident-response administration pages; the extensions appeared under different publisher names but shared code structure, targeting logic, and infrastructure, indicating coordinated activity. Separately, LayerX documented continued activity in the **GhostPoster** campaign across Chrome, Firefox, and Edge, adding 17 more extensions with a combined ~840,000 installs. The extensions concealed malicious JavaScript in image assets (e.g., logo files) to fetch an obfuscated payload that monitored browsing, planted a backdoor, hijacked affiliate links, and injected invisible iframes to drive **ad/click fraud**; LayerX assessed the operation likely originated in the Edge ecosystem and later expanded, with some extensions reportedly present since 2020, suggesting long-lived persistence despite prior public exposure by Koi Security.
Jun 29, 2026
A widespread malware campaign has leveraged browser extensions to infect millions of users, primarily through Chrome and Edge platforms. The operation, identified as "ShadyPanda," involved at least 145 malicious extensions, some of which initially appeared legitimate but were later updated to include spyware and remote code execution capabilities. These extensions engaged in affiliate fraud, search hijacking, and exfiltration of sensitive user data, with some remaining active on the Microsoft Edge Add-ons platform despite removal from the Chrome Web Store. Attackers manipulated installation counts to boost the perceived legitimacy of their extensions, making them more likely to be trusted and installed by users. Similar tactics have been observed in other campaigns, such as the resurgence of "Glassworm," which targets popular developer tool extensions by cloning them, inflating download statistics, and later updating them with malicious code. Attackers exploit the trust users place in well-known extensions and the difficulty in distinguishing between legitimate and malicious versions, especially within code editor marketplaces. These evolving threats highlight the ongoing risks posed by browser and code editor extensions, particularly as attackers refine their methods to evade detection and maximize impact.
Jun 29, 2026