Loading story…
Researchers detailed multiple malware operations that silently modify major web browsers to inject unauthorized ads and generate affiliate revenue. Microsoft said the Adrozek campaign affected Microsoft Edge, Google Chrome, Yandex Browser, and Mozilla Firefox, using large volumes of polymorphic samples from 159 distribution domains to alter browser components, disable security checks, tamper with updates, and persist through registry changes and services. The activity peaked at more than 30,000 impacted devices per day and was concentrated across Europe, South Asia, and Southeast Asia; on Firefox, the malware also decrypted and stole stored credentials for exfiltration.
Walmart Global Tech separately reported that the Pbot adware framework evolved from earlier activity into a more complex, staged infection chain delivered through NSIS installers and bundled components including a Chrome extension named Kodobi. The updated malware used obfuscated Python scripts, persistence mechanisms, DNS TXT records carrying base64-encoded URLs, and JavaScript-based payload delivery to fetch configuration files, inject ads, and perform fake clicks for advertising fraud. The report linked parts of the infrastructure and build artifacts to an affiliate-style monetization ecosystem associated with AdvPartners-related URLs, underscoring how browser-focused ad fraud malware has grown more persistent, modular, and financially motivated.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Walmart Global Tech published updated findings on Pbot, describing NSIS-based installers, bundled Kodobi components, DNS TXT-based update resolution, staged JavaScript delivery, and links to an affiliate-style ad-fraud ecosystem.
Microsoft disclosed technical details on Adrozek, describing how it modified Edge, Chrome, Yandex Browser, and Firefox to inject ads, maintain persistence, and in Firefox steal stored credentials.
Microsoft said Adrozek peaked in August 2020 at more than 30,000 affected devices per day, with activity concentrated in Europe, South Asia, and Southeast Asia.
Microsoft reported that the Adrozek browser-modifier malware campaign had been active since at least May 2020, using drive-by downloads and broad distribution infrastructure to infect devices.
The Walmart analysis states that Pbot, a Python-based adware framework, had previously been documented by Malwarebytes in 2018 and had not changed substantially since then.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 90 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026
Multiple active **social-engineering-driven malware operations** are targeting end users through trusted distribution channels. One campaign, dubbed **GhostPoster**, distributed **17 malicious browser extensions** across *Chrome, Firefox, and Edge* with **840,000+ installs**, using legitimate-sounding names (e.g., “Google Translate in Right Click,” “Youtube Download,” “Ads Block Ultimate”) and evading store reviews for years. The extensions used **steganography** to hide code in PNGs, then extracted payloads to contact attacker infrastructure, enabling credential/data theft, tracking, affiliate-link hijacking, script injection, and HTTP header manipulation to weaken protections. Separately, threat actors are impersonating **Malwarebytes** via trojanized ZIP “installers” (e.g., `malwarebytes-windows-github-io-X.X.X.zip`) and using **DLL sideloading**—pairing a legitimate EXE with a malicious `CoreMessaging.dll`—to execute **infostealers**; reporting highlighted a campaign fingerprint via **behash** `4acaac53c8340a8c236c91e68244e6cb` and distinctive DLL strings used for infrastructure mapping. A different operation identified by CloudSEK involves **“RedLineCyber”** masquerading as an affiliate of “RedLine Solutions” to build credibility inside private **Discord** communities and deliver a Python-based **clipboard hijacker** (often `Pro.exe` / `peeek.exe`) aimed at **cryptocurrency wallet theft**, relying on long-term grooming of high-value targets rather than broad phishing.
Jun 29, 2026
A widespread malware campaign has leveraged browser extensions to infect millions of users, primarily through Chrome and Edge platforms. The operation, identified as "ShadyPanda," involved at least 145 malicious extensions, some of which initially appeared legitimate but were later updated to include spyware and remote code execution capabilities. These extensions engaged in affiliate fraud, search hijacking, and exfiltration of sensitive user data, with some remaining active on the Microsoft Edge Add-ons platform despite removal from the Chrome Web Store. Attackers manipulated installation counts to boost the perceived legitimacy of their extensions, making them more likely to be trusted and installed by users. Similar tactics have been observed in other campaigns, such as the resurgence of "Glassworm," which targets popular developer tool extensions by cloning them, inflating download statistics, and later updating them with malicious code. Attackers exploit the trust users place in well-known extensions and the difficulty in distinguishing between legitimate and malicious versions, especially within code editor marketplaces. These evolving threats highlight the ongoing risks posed by browser and code editor extensions, particularly as attackers refine their methods to evade detection and maximize impact.
Jun 29, 2026