4.3 Million Browsers Compromised via Malicious Extensions

Du'aine Davis

Observed in the wild

• Threat actor ShadyPanda ran a seven-year campaign exploiting Chrome and Edge browser extensions, infecting 4.3 million users. Initially launched as legitimate tools, these extensions were later weaponised via silent updates. The most severe phase began mid-2024, introducing remote code execution (RCE) backdoors and spyware, enabling full browser surveillance and data exfiltration.
• ShadyPanda leveraged trusted extension marketplaces, gaining “Featured” and “Verified” status before deploying malicious updates. Techniques included search hijacking, cookie theft, and hourly RCE payloads via auto-update mechanisms. Data exfiltration targeted URLs, search queries, clicks, and browser fingerprints, with traffic routed to servers in China. Obfuscation and anti-analysis measures ensured persistence and evasion.
• Organisations should urgently audit installed browser extensions and remove those listed in IOCs. Use Microsoft Defender for Endpoint to detect suspicious behaviours such as frequent JavaScript execution, service worker manipulation, and encrypted outbound traffic to known C2 domains. Implement behavioural monitoring for extensions post-installation, enforce strict extension policies, and block unverified marketplace downloads.

4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign | Koi Blog