extension-plugin-hijackcredential-stealer-activitycommand-and-control-methodidentity-impersonation-fraud

Malicious Chrome and Edge Extensions Stole Data From 2.3 Million Users

Supply Chain Risk · 2 sources · Updated 2mo ago · First seen Sep 17, 2026

Researchers identified a campaign involving 19 malicious browser extensions distributed through the Google Chrome Web Store and Microsoft Edge Add-ons marketplace, with reported installations exceeding 2.3 million users. Fourteen extensions were published as apparently legitimate software, while five were acquired from their original developers and later updated with malicious functionality, leaving users unaware that ownership and code had changed.

The extensions contacted command-and-control infrastructure to retrieve replaceable modules, bypassed Content Security Policy controls, and injected code into targeted web pages. They could steal credentials, payment data, Facebook and LinkedIn information, browsing history, cryptocurrency assets, and hardware-wallet seed phrases; some also overlaid pages with ClickFix lures that impersonated browser-update notices and persuaded victims to run malicious commands, potentially extending compromise beyond the browser.

Does this reach your builds?Trace attribution and downstream blast radius.

Trace the chain

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events

Reported Sep 17, 20262mo ago
Researchers identified data theft, cryptodraining, and ClickFix capabilities
Researchers identified 16 malicious modules that could steal web-form credentials and payment data, Facebook and LinkedIn data, browsing history, cryptocurrency assets, and hardware-wallet seed phrases. Other modules replaced page content with ClickFix prompts designed to persuade victims to run malicious commands outside the browser.
Вредоносные плагины Chrome и Edge: как их обнаружить и чем они опасны | Блог Касперского
Reported Sep 17, 20262mo ago
Researchers reported 19 malicious Chrome and Edge extensions
At the end of August, researchers reported finding 18 malicious Google Chrome extensions and one malicious Microsoft Edge extension. They assessed that the 19 extensions were likely part of one campaign because of similarities in their malicious code and techniques.
Вредоносные плагины Chrome и Edge: как их обнаружить и чем они опасны | Блог Касперского
Reported Sep 17, 20262mo ago
Malicious updates were delivered through Chrome and Edge extension stores
The operators added malicious functionality to the extensions through subsequent updates, including automatic Chrome updates. The extensions contacted command-and-control servers for changeable malicious modules and disabled Content Security Policy protections to inject code into victims' visited pages.
Вредоносные плагины Chrome и Edge: как их обнаружить и чем они опасны | Блог Касперского
Reported Sep 17, 20262mo ago
Operators built and acquired browser extensions with existing user bases
The operators created 14 extensions that initially offered their advertised legitimate functions and acquired five legitimate extensions from their developers, including their existing user bases. Users were not notified when ownership changed.
Вредоносные плагины Chrome и Edge: как их обнаружить и чем они опасны | Блог Касперского
Reported Jul 8, 20251y ago
Millions of users installed browser extensions later identified as malware
A Koi Security report stated that Google and Microsoft had trusted malicious extensions that were installed by 2.3 million users.
Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.

Do you run this?See attribution and downstream blast radius, and whether this package or vendor reaches your builds.

Trace the Supply Chain

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Kaspersky RuNews · Sep 17, 2026

Вредоносные плагины Chrome и Edge: как их обнаружить и чем они опасны | Блог КасперскогоOpen source ↗

Koi SecurityNews · Jul 8, 2025

Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

extension-plugin-hijackcredential-stealer-activitycommand-and-control-methodidentity-impersonation-fraud

Malicious Chrome and Edge Extensions Stole Data From 2.3 Million Users

Supply Chain Risk · 2 sources · Updated 2mo ago · First seen Sep 17, 2026

Does this reach your builds?Trace attribution and downstream blast radius.

Trace the chain

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events

Reported Sep 17, 20262mo ago
Researchers identified data theft, cryptodraining, and ClickFix capabilities
Researchers identified 16 malicious modules that could steal web-form credentials and payment data, Facebook and LinkedIn data, browsing history, cryptocurrency assets, and hardware-wallet seed phrases. Other modules replaced page content with ClickFix prompts designed to persuade victims to run malicious commands outside the browser.
Вредоносные плагины Chrome и Edge: как их обнаружить и чем они опасны | Блог Касперского
Reported Sep 17, 20262mo ago
Researchers reported 19 malicious Chrome and Edge extensions
At the end of August, researchers reported finding 18 malicious Google Chrome extensions and one malicious Microsoft Edge extension. They assessed that the 19 extensions were likely part of one campaign because of similarities in their malicious code and techniques.
Вредоносные плагины Chrome и Edge: как их обнаружить и чем они опасны | Блог Касперского
Reported Sep 17, 20262mo ago
Malicious updates were delivered through Chrome and Edge extension stores
The operators added malicious functionality to the extensions through subsequent updates, including automatic Chrome updates. The extensions contacted command-and-control servers for changeable malicious modules and disabled Content Security Policy protections to inject code into victims' visited pages.
Вредоносные плагины Chrome и Edge: как их обнаружить и чем они опасны | Блог Касперского
Reported Sep 17, 20262mo ago
Operators built and acquired browser extensions with existing user bases
The operators created 14 extensions that initially offered their advertised legitimate functions and acquired five legitimate extensions from their developers, including their existing user bases. Users were not notified when ownership changed.
Вредоносные плагины Chrome и Edge: как их обнаружить и чем они опасны | Блог Касперского
Reported Jul 8, 20251y ago
Millions of users installed browser extensions later identified as malware
A Koi Security report stated that Google and Microsoft had trusted malicious extensions that were installed by 2.3 million users.
Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.

Do you run this?See attribution and downstream blast radius, and whether this package or vendor reaches your builds.

Trace the Supply Chain

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Kaspersky RuNews · Sep 17, 2026

Вредоносные плагины Chrome и Edge: как их обнаружить и чем они опасны | Блог КасперскогоOpen source ↗

Koi SecurityNews · Jul 8, 2025

Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Malicious Chrome and Edge Extensions Stole Data From 2.3 Million Users

How this story unfolded

Researchers identified data theft, cryptodraining, and ClickFix capabilities

Researchers reported 19 malicious Chrome and Edge extensions

Malicious updates were delivered through Chrome and Edge extension stores

Operators built and acquired browser extensions with existing user bases

Millions of users installed browser extensions later identified as malware

Sources

See the full picture, correlated to your attack surface.

Related stories

Superior Browser Extensions Stole Crypto Wallets, Credentials and Browser Data

Malicious Browser Extensions Used for Stealthy Data Theft and Account Takeover

Malicious Chrome Extensions Used for Data Theft via Ownership Transfers and Impersonation

Malicious Chrome and Edge Extensions Stole Data From 2.3 Million Users

How this story unfolded

Researchers identified data theft, cryptodraining, and ClickFix capabilities

Researchers reported 19 malicious Chrome and Edge extensions

Malicious updates were delivered through Chrome and Edge extension stores

Operators built and acquired browser extensions with existing user bases

Millions of users installed browser extensions later identified as malware

Sources

See the full picture, correlated to your attack surface.

Related stories

Superior Browser Extensions Stole Crypto Wallets, Credentials and Browser Data

Malicious Browser Extensions Used for Stealthy Data Theft and Account Takeover

Malicious Chrome Extensions Used for Data Theft via Ownership Transfers and Impersonation