Browser extension stores face persistent security threats from large-scale malware campaigns impacting millions of users and stealing digital assets. Threat actors deploy sophisticated techniques, including sleeper agents that remain benign for years, steganographic payloads hidden inside image files, and AI-generated code to evade standard detection.
These malicious extensions primarily target sensitive data, including cryptocurrency wallets, session tokens, and credentials via silent updates. Because official store review processes frequently miss these dynamic threats, mitigating risks requires enterprise access controls, regular extension audits, and specialized behavioral detection tools to identify unauthorized activity.
Malicious Browser Extensions: 2025-2026 Comprehensive Threat Analysis Report — October 29, 2026
Sources: Koi Security, Socket, Malwarebytes, Palo Alto Networks, LayerX, ACM Research, Mozilla, Google
Executive Summary The browser extension ecosystem has become one of the most active vectors for large-scale malware distribution. Official stores — Chrome Web Store (111,933 extensions) and Firefox Add-ons (39,600 analyzed) — are not immune. Documented campaigns have collectively infected over 8.8 million users , stolen over $1 million in cryptocurrency , and established persistent remote-code-execution backdoors.
Key Finding: Sleeper Agents Extensions operated legitimately for 5–7 years before weaponization via silent update. Chrome and Edge auto-update delivered malware to entire user bases without user consent.
Key Finding: Steganographic Payloads Malicious JavaScript hidden inside PNG icon files bypasses static analysis and review processes. Activation probability set to 10% to evade behavioral detection.
Key Finding: AI-Assisted Malware AI-generated code used to scale campaigns (150+ extensions in GreedyBear). LLMs accelerate malware production, enabling rapid variation and evasion.
1. Threat Landscape Overview Browser Extension Stores: Attack Surface vs. Detected Risks Chrome Web Store 111,933 exts 88 CRIT, 429 HIGH Firefox Add-ons 39,600 analyzed 68 CRIT, 84 HIGH Low/Minimal/Medium High Risk Critical Risk Impact Summary 8.8M+ users infected $1M+ crypto stolen 23+ campaigns identified
Market Size and Attack Surface Store Extensions Analyzed Critical/High Risks Chrome Web Store ~111,933 289,600 (RiskyPlugins) 88 critical, 429 high Firefox Add-ons ~120,000+ 39,600 (RiskyPlugins) 68 critical, 84 high Edge Add-ons Shared w/ Chrome — Many campaigns persist here
Campaign Timeline (2025-2026) Major Malicious Extension Campaigns: Apr 2025 — Oct 2026 Apr 25 Jul 25 Sep 25 Dec 25 Jan 26 Apr 26 Jun 26 Jul 26 Oct 26 40+ Firefox wallet clones 18 sleeper agents (2.3M) 16 ChatGPT stealers GreedyBear (150 exts, $1M) MEXC API key stealer GhostPoster (17 FF, 50K) ShadyPanda (145 exts, 4.3M) GhostPoster +17 (840K) Zoom Stealer (18 exts) 108 Chrome OAuth stealers VPN Go clipboard J7Tracker/VREO 16 Rabby/OKX clones 3 Phantom/Jup/Bitget
Threat Category Distribution Category Chrome Campaigns Firefox Campaigns Estimated Users Crypto wallet theft 3 5 250K+ Browser surveillance/spyware 4 2 6M+ Session hijacking 3 1 100K+ Browser hijacking/redirect 2 1 2.3M+ Clipboard/credential theft 2 2 50K+ Ad fraud/affiliate fraud 1 1 890K+ OAuth token theft 1 0 20K+
2. Chrome Extension Campaigns 2.1 ShadyPanda (DarkSpectre) — Critical Discoverer Koi Security (Dec 2025) Total Extensions 20 Chrome (145 total w/ Edge) Total Installs 4.3 million (Chrome + Edge)Status Removed from Chrome; some still live on Edge TTPs Sleeper agent: 5–7 years clean operation before weaponization via silent update Impact RCE backdoor (300K users) + full spyware (4M users)
Extension Name Chrome ID Installs Risk Clean Master eagiakjmjnblliacokhcalebgnhellfi 200,000+ Critical Speedtest Pro ibiejjpajlfljcgjndbonclhcbdcamai — High BlockSite ogjneoecnllmjcegcfpaamfpbiaaiekh — High Address Bar Search Switcher jbnopeoocgbmnochaadfnhiiimfpbpmf — High SafeSwift New Tab cdgonefipacceedbkflolomdegncceid — High Infinity V+ New Tab gipnpcencdgljnaecpekokmpgnhgpela — High OneTab Plus bpgaffohfacaamplbbojgbiicfgedmoi — High Infinity New Tab nnnklgkfdfbdijeeglhjfleaoagiagig — High Dream Afar New Tab lehjnmndiohfaphecnjhopgookigekdk — Medium Download Manager Pro hlcjkaoneihodfmonjnlnnfpdcopgfjk — Medium Galaxy Theme Wallpaper hmhifpbclhgklaaepgbabgcpfgidkoei — Medium Halo 4K Wallpaper lnlononncfdnhdfmgpkdfoibmfdehfoj — Medium
2.2 GhostPoster (DarkSpectre) — High Discoverer Koi Security / LayerX Extensions 17 original + 17 expanded = 34 total Downloads 890,000+ TTPs Steganographic payload in PNG icons; 10% activation rate
Identified Chrome/Edge extensions:
Extension Name Risk Google Translate in Right Click High Ads Block Ultimate High Amazon Price History High Convert Everything High Instagram Downloader High One Key Translate High Translate Selected Text with Google High Translate Selected Text with Right Click High Youtube Download High Color Enhancer Medium Cool Cursor Medium Floating Player – PiP Mode Medium Full Page Screenshot Medium Page Screenshot Clipper Medium RSS Feed Medium Save Image to Pinterest Medium
2.3 Zoom Stealer (DarkSpectre) — High Discoverer Koi Security (Jan 2026) Extensions 18 (Chrome, Edge, Firefox) TTPs Harvests Zoom/Google Meet URLs, passwords, IDs, topics
Extension Name Chrome ID Risk Chrome Audio Capture kfokdmfpdnokpmpbjhjbcabgligoelgp High ZED: Zoom Easy Downloader pdadlkbckhinonakkfkdaadceojbekep High X (Twitter) Video Downloader akmdionenlnfcipmdhbhcnkighafmdha High Google Meet Auto Admit pabkjoplheapcclldpknfpcepheldbga High Zoom.us Always Show “Join From Web” aedgpiecagcpmehhelbibfbgpfiafdkm High Timer for Google Meet dpdgjbnanmmlikideilnpfjjdbmneanf High CVR: Chrome Video Recorder kabbfhmcaaodobkfbnnehopcghicgffo High GoToWebinar Download Recordings cphibdhgbdoekmkkcbbaoogedpfibeme High Meet auto admit ceofheakaalaecnecdkdanhejojkpeai High Zoomcoder Extension ebhomdageggjbmomenipfbhcjamfkmbl High Auto-join for Google Meet ajfokipknlmjhcioemgnofkpmdnbaldi High Google Meet Tweak dakebdbeofhmlnmjlmhjdmmjmfohiicn Medium Mute All on Meet adjoknoacleghaejlggocbakidkoifle Medium Google Meet Push-To-Talk pgpidfocdapogajplhjofamgeboonmmj Medium Photo Downloader ifklcpoenaammhnoddgedlapnodfcjpn Medium
2.4 108-Extension Data Exfiltration — Critical Discoverer Socket Threat Research (Apr 2026) Extensions 108 total Installs ~20,000 Publishers Yana Project, GameGen, SideGames, Rodeo Games, InterAlt (single operator) C2 cloudapi.stream, mines.cloudapi.stream, top.rodeo Breakdown 54 OAuth2 stealers, 1 Telegram session theft, 45 backdoors, 2 ad injection, 1 translation proxy
Extension Name Chrome ID Threat Risk Telegram Multi-account obifanppcpchlehkjipahhphbcbjekfa Telegram session theft (15s interval) Critical Web Client for Telegram – Teleside mdcfennpfgkngnibjbpnpaafcjnhcjno Staged Telegram theft Critical Formula Rush Racing Game akebbllmckjphjiojeioooidhnddnplj Google OAuth2 identity theft High Web Client for Youtube – SideYou bfoofgelpmalhcmedaaeogahlmbkopfd Content injection High Web Client for TikTok cbfhnceafaenchbefokkngcbnejached Content injection High Text Translation ogogpebnagniggbnkbpjioobomdbmdcj Translation proxy High Page Locker ldmnhdllijbchflpbmnlgndfnlgmkgif Backdoor High YouSide – Youtube Sidebar mmecpiobcdbjkaijljohghhpfgngpjmk Backdoor High Page Auto Refresh lnajjhohknhgemncbaomjjjpmpdigedg Backdoor High Clear Cache Plus bgdkbjcdecedfoejdfgeafdodjgfohno OAuth2 + backdoor High Speed Test for Chrome bpljfbcejldmgeoodnogeefaihjdgbam OAuth2 + backdoor High
96 additional game/utility extensions in the same campaign share identical C2 infrastructure. Full list in the Markdown report.
2.5 Chrome Sleeper Agent Campaign (18 extensions) — High Discoverer Koi Security (Jul 2025) Chrome Installs 1.7 million (2.3M with Edge) Status All removed from Chrome Web Store TTPs Background service worker listener; URL capture + redirect hijacking
Extension Name Risk Color Picker, Eyedropper — Geco colorpick High Emoji keyboard online High Free Weather Forecast High Video Speed Controller High Unlock Discord — VPN Proxy High Dark Theme — Dark Reader for Chrome High Volume Max — Ultimate Sound Booster High Unblock TikTok High Unlock YouTube VPN High Unlock TikTok High Weather High
2.6 Additional Chrome Campaigns Campaign Extensions Downloads Risk ChatGPT Session Stealer (Malwarebytes, Jan 2026) 15 Chrome + 1 Edge ~900 High MEXC API Key Stealer (Socket, Sep 2025) 1 — Critical GenAI Extension RATs (Palo Alto Unit 42) 18 — Critical J7Tracker/VREO/GhostApe (Socket, Jul 2026) 4 — High VPN Go Clipboard Stealer (Socket, Jun 2026) 1 Chrome 146 High
3. Firefox Extension Campaigns 3.1 GreedyBear — Critical Discoverer Koi Security (Aug 2025) Extensions 150 Estimated Theft $1,000,000+ in cryptocurrencyStatus Removed from Firefox Add-ons TTPs Upload benign, accumulate fake reviews, strip branding, inject keylogger for wallet credentials Impersonated MetaMask, TronLink, Rabby, and other crypto platforms
3.2 GhostPoster (Firefox) — High Discoverer Koi Security (Dec 2025) Extensions 17 Downloads 50,000+ TTPs Malicious JavaScript hidden in PNG icon files; payload on 10% of loads
Extension Name Risk Free VPN Forever High Weather Best Forecast High Cache Fast Site Loader High FreeMP3Downloader High Google Translate Right Clicks High Google Traductor Esp High World Wide VPN High Translator GBBd High Google Translate Pro Extension High LibreTV Watch Free Videos High Right Click Google Translate High Screenshot Saved Easy Medium CrxMouse Gesture Medium Dark Reader for FF Medium I Like Weather Medium Ad Stop Medium
3.3 Crypto Wallet Impersonation Wave (40+ extensions) — Critical Discoverer Koi Security / Zen Security (Jul 2025) Extensions 40+ Status Removed (except MyMonero at reporting time) Impersonated Coinbase, MetaMask, Trust Wallet, Phantom, Exodus, OKX, Keplr, MyMonero, Bitget, Leap, Ethereum Wallet, Filfox
Key extension IDs (subset):
Extension ID/Name Risk metamask-addons Critical metamask-crypto-official Critical metamask-for-firefox Critical phantom-ext-off Critical phantom-wallet-extension Critical trust-wallet-mozilla-add Critical trust-extension-wallet Critical okx-wallet-extension Critical keplr-wallet Critical filfox-wallet Critical leap-wallet Critical bitget-by-addon Critical coinbasewallet Critical ethereum-wallet Critical mymonero-wallet Critical
3.4 Phantom/Jupiter/Bitget Impersonators (3 extensions) — Critical Discoverer Socket / Malwarebytes (Oct 2026) TTPs Full wallet takeover: read input, detect paste, scan screens; auto-move funds to multi-chain payout addresses
Extension Add-on ID Risk Phantom impersonator 3092199 Critical Jupiter impersonator 3092666 Critical Bitget impersonator 3092059 Critical
3.5 Rabby/OKX Wallet Clones (16 extensions) — Critical Discoverer Socket (Oct 2026) Extensions 16 (4 Rabby clones, 12 OKX clones) C2 *.icy-star-f45c.workers.dev (Cloudflare Workers) Status All removed as of Oct 5, 2026
Extension ID Risk view-focus-bright@webtools.co@6.12.2 Critical quick-track-nest@tabtools.co@8.1.18 Critical vibe-kit-tool@fasttools.co@9.21.9 Critical edge-hub-snap@protools.net@4.12.24 Critical core-hub-peak@neattools.example@8.24.21 Critical sipoo-grozza@browserweb.com@2.1 Critical mozart-seo@webtools.com@1.4 Critical clean-file-bar@neattools.com@4.21.8 Critical clean-net-timer@plugify.example@4.17.1 Critical manager-square@webtools.com@1.4 Critical val-andrew@browserweb.com@1.4 Critical manager-team@browserweb.com@1.4 Critical franklin-uk@browserweb.com@1.4 Critical franklin-uro@browserweb.com@1.4 Critical
3.6 Additional Firefox Campaigns Campaign Extensions Downloads Risk VPN Go Clipboard Stealer (Socket, Jun 2026) 1 3,499 High Orbit Tracker (Socket, 2026) 1 — High VREO (Socket, 2026) 1 — High Zoom Stealer Firefox variants 2 — High
4. Extension-by-Extension Registry Summary Risk Rating Distribution: All Named Extensions (268 total) 268 extensions 120 Critical (45%) 125 High (47%) 23 Medium (8%) Chrome: 137 named | Firefox: 131 named
Complete extension-by-Extension registry with all named extensions, Chrome IDs, and Firefox add-on IDs is in the Markdown report.
5. Risk Rating Methodology Factor Critical High Medium Data Accessed Financial credentials, private keys, session tokens OAuth tokens, browsing history, clipboard Limited data access Persistence RCE backdoor, self-updating Remote payload execution Static payload Impact Full account/wallet takeover Session hijacking, data exfiltration Surveillance, redirects Stealth Evasion, steganography Obfuscation, conditional activation Basic malicious code Propagation 100K+ installs or active C2 1K–100K installs or coordinated Isolated, small base
6. Attack Vectors and Techniques Sleeper Agent Pattern Extensions published as legitimate tools, accumulate users and reviews over years, then weaponized via silent update. ShadyPanda’s Clean Master operated cleanly for 7 years before turning into spyware with RCE backdoor.
Steganographic Payloads Malicious JavaScript hidden in PNG icon file bytes. Extension extracts payload at runtime. GhostPoster used 10% probability-based activation to evade detection. Newer variants encrypt payloads in arbitrary images.
Permission Abuse Broad permissions (proxy, webRequest, identity.getAuthToken, web_accessible_resources: [“*”]) used to intercept all traffic, steal OAuth tokens, and inject content. Legitimate-use permissions create false-positive noise.
AI-Assisted Malware Palo Alto Unit 42 found AI-generated code in 18 GenAI-themed RATs. GreedyBear used AI to generate 150+ extension variants. LLMs accelerate production and enable rapid evasion variation.
7. Threat Actor Attribution Actor Alias Attribution Campaigns Estimated Impact DarkSpectre Chinese threat actor ShadyPanda, GhostPoster, Zoom Stealer 8.8M users ShadyPanda Subset of DarkSpectre 145 extensions over 7 years 4.3M installs GreedyBear Unknown 150 Firefox wallet clones $1M+ stolen 108-Ext Campaign Single operator (5 fronts) 108 Chrome extensions 20K users MEXC Operator jorjortan142 (alias) MEXC API Automator Unknown GenAI RAT Operator Unknown 18 AI-themed RATs Unknown
8. Detection and Third-Party Tools Tool Coverage Accuracy Notes RiskyPlugins 289.6K Chrome, 39.6K Firefox Good Found 88 critical + 429 high on Chrome; automated static analysis Chrome-Stats Chrome Web Store Poor 45.7% of confirmed malicious scored “low risk”; unreliable Socket Chrome + Firefox Excellent Captured multiple campaigns pre-takedown; behavioral analysis Koi Security (Wings) All stores Excellent Discovered GhostPoster, ShadyPanda, GreedyBear; real-time engine Nerq 29,120 indexed Moderate Trust score 0–100; avg 51/100 VirusTotal Chrome extensions Poor ACM study: “work poorly to detect known malicious extensions”
Research and Community Databases Database Maintainer Coverage chrome-mal-ids The Privacy Commons Institute Thousands of IOCs across dozens of campaigns malext.io Community Real-time tracking from multiple sources malicious_extension_sentry toborrm9 Automated aggregation of Chrome removals
9. Store Security Mechanisms and Failure Modes Chrome Web Store Mechanisms Static analysis, Manifest V3, Safe Browsing, verification badges Failure 1 Sleeper agents: Cannot detect extensions that are clean at uploadFailure 2 Permissions: Broad permissions are legitimately usefulFailure 3 Manifest V3: 60+ extensions found ways around MV3 restrictionsFailure 4 Auto-update: Same mechanism delivers malware silentlyFailure 5 ML drift: Chrome-Stats scores unreliable for detection
Firefox Add-ons Mechanisms Automated review, early crypto scam detection, manual review, block list Failure 1 Lower detection: More susceptible to obfuscation (ArXiv study)Failure 2 Crypto persists: GreedyBear bypassed June 2025 detectionFailure 3 Steganography: PNG payloads bypass static analysisFailure 4 Volume: 120K+ extensions with limited staffing
11. Appendix: Indicators of Compromise C2 Domains and IPs Indicator Campaign Type extensionplay.com ShadyPanda C2 yearnnewtab.com ShadyPanda C2 / Exfiltration api.cgatgpt.net ShadyPanda C2 dergoodting.com ShadyPanda Exfiltration cleanmasters.store ShadyPanda Exfiltration s-85283.gotocdn.com ShadyPanda Exfiltration s-82923.gotocdn.com ShadyPanda Exfiltration tg.cloudapi.stream 108-Ext Campaign Telegram session C2 mines.cloudapi.stream 108-Ext Campaign OAuth2 exfiltration api.cloudapi.stream:8443 108-Ext Campaign C2 top.rodeo 108-Ext Campaign Backdoor 178.236.252.133 VPN Go Clipboard C2 178.236.252.161 VPN Go Clipboard C2 77.91.123.187 VPN Go Clipboard C2 (Phase 2) *.icy-star-f45c.workers.dev OKX/Rabby Cloudflare C2 bonto.io Phantom/Jupiter/Bitget Exfiltration phantom.bonto.io Phantom/Jupiter/Bitget Exfiltration jupiter.bonto.io Phantom/Jupiter/Bitget Exfiltration bitget.bonto.io Phantom/Jupiter/Bitget Exfiltration
References Koi Security — “4 Million Browsers Infected: Inside ShadyPanda’s 7-Year Malware Campaign” (Dec 2025) Koi Security — “Inside GhostPoster: How a PNG Icon Infected 50,000 Firefox Users” (Dec 2025) Socket Threat Research — “108 Chrome Extensions Linked to Data Exfiltration and Session Theft” (Apr 2026) Socket Threat Research — “Malicious Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers” (Jun 2026) Socket Threat Research — “Malicious Chrome Extension Steals MEXC API Keys” (Sep 2025) Malwarebytes — “Malicious Chrome extensions can spy on your ChatGPT chats” (Jan 2026) Malwarebytes — “Firefox joins Chrome and Edge as sleeper extensions spy on users” (Jan 2026) Malwarebytes — “Malicious Firefox extensions impersonate popular crypto wallets” (Oct 2026) LayerX — “Browser Extensions Gone Rogue: The Full Scope of the GhostPoster Campaign” (Jan 2026) Palo Alto Networks Unit 42 — “That AI Extension Helping You Write Emails? It’s Reading Your Emails” (2025) BleepingComputer — “ShadyPanda browser extensions amass 4.3M installs” (Dec 2025) BleepingComputer — “Malicious Chrome extensions with 1.7M installs found on Web Store” (Jul 2025) BleepingComputer — “Wave of 150 crypto-draining extensions hits Firefox add-on store” (Aug 2025) ACM Transactions on the Web — “It’s Not Easy: Applying Supervised ML to Detect Malicious Extensions” (2025) ArXiv 2503.04292 — “A Study on Malicious Browser Extensions in 2025” RiskyPlugins — Chrome Web Store Extension Security Analysis RiskyPlugins — Firefox Add-ons Extension Security Analysis The Privacy Commons Institute — chrome-mal-ids GitHub Repository Nerq — Browser Extension Trust Ratings 2026 Mozilla Security — Multiple takedown notices and detection system updates Report compiled October 29, 2026. Data reflects publicly available threat intelligence as of this date.
Extension status (live/removed) may have changed since analysis. All named extensions should be assumed removed from stores unless confirmed otherwise.
