Loading story…
Researchers identified a browser-extension campaign involving 19 malicious Chrome and Microsoft Edge extensions, including 14 published as apparently legitimate tools and five acquired from their original developers before receiving malicious updates. The extensions, reportedly installed by as many as 2.3 million users, contact attacker-controlled command-and-control infrastructure, retrieve replaceable modules, bypass Content Security Policy protections, and inject code into pages opened by targeted victims.
The extensions can exfiltrate browsing histories, credentials, payment data, Facebook and LinkedIn information, cryptocurrency assets, and hardware-wallet seed phrases. They also report visited URLs to attacker APIs and can redirect tabs to server-selected destinations for phishing and session theft; observed infrastructure includes ebmitab[.]com, abmitab[.]com, and addmitab[.]com. Some extensions replace pages with fake browser-update prompts that use ClickFix social engineering to induce victims to run malicious commands, extending compromise beyond the browser. Organizations should allowlist extensions, remove affected add-ons, and reset potentially exposed credentials and sessions.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
The identified extensions contacted command-and-control servers for changeable modules that disabled Content Security Policy and injected code into victims' browsed pages. Modules stole web-form credentials and payment data, targeted social-media and cryptocurrency accounts and wallet seed phrases, and displayed ClickFix prompts intended to convince victims to execute malicious commands outside the browser.
Researchers reported finding 18 malicious Google Chrome extensions and one malicious Microsoft Edge extension, which they assessed were probably part of one campaign based on shared code and methods. The extensions were either initially presented as legitimate or acquired from legitimate developers before malicious functionality was added through updates.
Koi Security reported that browser extensions trusted by Google and Microsoft had been installed by approximately 2.3 million users and were malware.
Researchers documented malicious or compromised browser extensions that sent visited URLs to attacker-controlled API endpoints and redirected tabs to server-supplied destinations, enabling potential phishing and credential or session theft. Examples included Flash Player for Chrome and SearchGPT, which communicated with ebmitab[.]com, abmitab[.]com, or addmitab[.]com.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
kaspersky.ru
Open sourceshroudcloud.io
Open sourceblog.koi.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026
Multiple **malicious Chrome/Chromium extensions** were identified abusing the Chrome Web Store to steal data from users and enterprises. Two previously legitimate extensions—**QuickLens** (`kdenlnncndfnhkognokgfpabgkgehodd`) and **ShotBird** (`gengfhhkjekmlejbhmmopegofnoifnjp`)—reportedly turned malicious after **ownership transfers**, enabling downstream compromise through injected code and data harvesting. In the QuickLens case, researchers reported the malicious update preserved expected functionality while adding capabilities to **strip security headers** (e.g., `X-Frame-Options`) and facilitate script injection that can bypass **Content Security Policy (CSP)** protections, expanding the attacker’s ability to make cross-domain requests and collect sensitive information. Separately, Microsoft reported a campaign of **counterfeit “AI assistant” browser extensions** distributed via the Chrome Web Store (and therefore also impacting Microsoft Edge environments that allow Chrome extensions), which allegedly affected **20,000+ enterprise tenants** and amassed roughly **900,000 installs**. These extensions impersonated legitimate AI productivity tools and harvested **ChatGPT/DeepSeek conversation histories**, visited URLs, and browsing telemetry, staging data for exfiltration to attacker-controlled infrastructure. Another Chrome Web Store threat involved a fake **imToken**-branded extension (“lmΤoken Chromophore”) that masqueraded as a benign tool but redirected victims to phishing infrastructure to steal **seed phrases and private keys**, using tactics like hardcoded remote configuration (via JSONKeeper) and decoy navigation to the legitimate `token.im` site after credential capture.
Jun 29, 2026
Researchers uncovered the **Superior** campaign, in which attackers distributed 18 malicious Chrome extensions and one Microsoft Edge extension that stole cryptocurrency-wallet secrets, credentials, browser data, and social-media sessions. The operator reportedly acquired legitimate extensions—or first published benign versions—then used automatic extension updates to install a modular malware framework after building an install base; the activity may have begun in early 2024. The extensions used encrypted persistent WebSocket connections for command-and-control, received rotatable infrastructure endpoints, removed page Content Security Policy headers, and injected malicious scripts into sites victims visited. Modules supported wallet draining, seed-phrase phishing, exchange-session theft, form and credential capture, browser-history collection, and ClickFix-style fake-update lures. Google removed the identified Chrome extensions, but an affected Edge extension remained available at reporting time; users should remove affected extensions, change passwords, revoke active sessions, and move cryptocurrency to newly created wallets.
Sep 4, 2026