Home / Technology / Millions Exposed: Trusted Extensions Secretly Became Spyware
Millions Exposed: Trusted Extensions Secretly Became Spyware
12 Dec
Summary
- Malware campaign infected 4.3 million users via Chrome and Edge extensions.
- Extensions were updated silently, turning them into spyware over time.
- Attackers collected extensive personal data, including keystrokes and mouse movements.
A prolonged malware campaign has been uncovered, targeting millions of users through seemingly innocuous browser extensions. The ShadyPanda operation affected an estimated 4.3 million individuals by converting legitimate Chrome and Edge add-ons into sophisticated spyware over several years. These extensions began as simple tools but were later updated through trusted auto-update systems, adding hidden surveillance functions without user interaction.
The compromised extensions injected tracking code, hijacked searches, and logged a wide array of personal data, including browsing history, keystrokes, and mouse movements. Attackers gained remote code execution capabilities, allowing for full browser control and data exfiltration. The extensions could also perform adversary-in-the-middle attacks for credential theft and code injection.
Following the discovery, Google and Microsoft have removed the identified malicious extensions from their respective stores. Users are advised to review their installed extensions, reset passwords, and consider data removal services to mitigate risks from this widespread campaign.
