Over 4.3 million browser extensions have been installed over the course of a seven-year operation by a threat actor identified as ShadyPanda.
Five of these extensions started off as genuine programs before malicious alterations were deployed in mid-2024, according to a research by Koi Security, drawing 300,000 installs. Since then, these extensions have been removed.
According to a study provided with The Hacker News by security researcher Tuval Admoni, these extensions now perform hourly remote code execution, downloading and running any JavaScript with complete browser access. They track every website visit, exfiltrate encrypted browsing history, and capture entire browser fingerprints.
To exacerbate the situation, Google once featured and validated one of the extensions, Clean Master. This trust-building activity allowed the attackers to grow their user base read more about ShadyPanda Turns Popular Browser Extensions with 4.3 Million Installs Into Spyware.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.