119 Edge extensions promised useful tools, instead downloaded malware_MALWAREBYTES:5E2D00C93323F5A75AF36EF6CFB363CE

{
    "lastseen": "2026-06-29T15:38:50",
    "description": "Microsoft has removed 119 extensions from the Edge add-on store which were all tied to one adware campaign.\n\nIn a paper titled \"Inside StegoAd: How We Disrupted a Massive Malicious Extension Campaign,\" Microsoft researchers detail how they uncovered and dismantled a sophisticated malware campaign that abused browser extensions to infect users. According to Microsoft, the campaign involved 119 malicious browser extensions which were downloaded by 2.6 million users.\n\nThe extensions all promised, and delivered, some kind of basic functionality: ad blockers, VPNs, translators, video downloaders, calculators, coupon extensions and so on. But after a while they turned out to be \u201csleepers\u201d and secretly started downloading additional malware.\n\nAmong the payload was malware involved in ad fraud, but also extensions that ran arbitrary JavaScript pushed from the server, which stole Google credentials and second-factor codes at sign-in, harvested WordPress admin logins, and exfiltrated cookies in bulk for session hijacking.\n\nThe name of the campaign \u201cStegoAd\u201d is derived from the words advertising and steganography, which means techniques of hiding secrets in something that doesn\u2019t immediately cause suspicion. In this case, hiding code in images.\n\nAnd not only did the cybercriminals try to stay under the radar by waiting for some time, and hiding malicious code inside images, they also left some victims alone. Some of the extensions only went rogue in about 10% of installs, which would actually execute the next stage of the malware, while the other ~90% would be left alone (at least for that execution attempt). And, in some cases, they re-used names of well-known legitimate extensions to install an additional level of trust.\n\nBrowser extensions are a source of wealth for cybercriminals because it compares to installing a small program that lives inside your browser, which can see and report about everything you do on the internet.\n\nNow I hear some of you thinking: I don\u2019t use Edge. Or I've used it just once, to download and install my favorite browser. But although Microsoft discovered and analyzed the campaign, the techniques used in this campaign are applicable to Chromium-based browsers in general.\n\nThis campaign was less about exploiting a browser vulnerability and more about tricking users into installing a trusted-looking extension, then using sophisticated concealment techniques to avoid detection long enough to compromise systems.\n\n## How to stay safe\n\nAlways be careful when downloading extensions, even from the reputable app stores. As we've seen many times before, criminals manage to get their apps or extensions listed when they are only one update away from turning into malware. So, make sure that you trust the developer and don\u2019t rely on reviews alone.\n\nUse an up-to-date real-time security solution to detect and remove malicious extensions from your device and block connections to malicious domains and IP addresses. Remove the known malicious extensions from your browser. Below is an alphabetical list of the malicious extensions the researchers found by name.\n\nPlease note that there might be more than one extension that has the same name. In case you doubt whether the extension you have installed is among them, check whether the ID matches the one shown in the list. If you prefer looking them up by ID, you can find them organized differently in the Microsoft report (pages 40-43).\n\n**Extension Name**| **Extension ID**  \n---|---  \n#Best# PDF Saver| jebcdimkcimkafekgbgbhookdajcoeib  \n\"Download\" Button for YouTube| jbmkcmhocoddcokjkahpcchanlmiffhg  \n\"Save\" Button for Pinterest| fhkijdlfjnpimenfpnegkecbbijmoipm  \n\u2026Page Screenshot Clipper| maiackahflfnegibhinjhpbgeoldeklb  \n7TV| nmhdjlflloeeahacgomilnhmpfnhlpkn  \nAdblock| aooacabidfijofopjaeligonlfobjcjb  \nAdblock| dckihkcdmjmlkndgmmgplpcnkmdpangb  \nAdblock (\u00b5Block clone)| kmiahfbflcnmlobepelpgkmolhodmiek  \nAdblock For Edge| kikacehfccglblphddbifmiaeiglfdfi  \nAdblock Master| dgmpkflgbcbpjgniahjegbpelmofbgnn  \nAdblock Master| hninibdhkeepfndhcdknlijeapngbgdp  \nAdblock Master for Youtube| jnakfjmfmjmfpmdnghedafdphdanbjkh  \nAdblock for Youtube| afakckepbbffmnoghgpfnnebijeahjcb  \nAdblock for Youtube| gclhifbbggfamoojmienffegbmmfnfll  \nAdblock for Youtube![\u2122](https://s.w.org/images/core/emoji/17.0.2/72x72/2122.png)| nipggfgilmoiofmnkbeabghbcaohmjih  \nAdblocker FX| fkkoeecbjckjpnmenebojblcljjgbpoj  \nAdblocker Plus for YouTube![\u2122](https://s.w.org/images/core/emoji/17.0.2/72x72/2122.png)| imiheoejheaebigkjaeilfmekiikjdbd  \nAdFly Skipper for Edge| nhfohdhgahjpmniccbgflilignkcnmai  \nAdSkip-\u7231\u5947\u827a| mimmainmmkddahakleojidjaimaofndp  \nAds Block Ultimate| fbobegkkdmmcnmoplkgdmfhdlkjfelnb  \nAI Search GPT for Edge| beemogkfhphmjghmkghdaggidgohohee  \nAI Search with ChatGPT| jgngkchljnldpnjimaboboomjmpfpoie  \nAI Weather Forecast| iaehhmhmdidpkfmddiodkloefndpggcj  \nAliExpress Helper| elecjoakfjcmjoppfconlfgfemjcaoea  \nAuto Skip Ads on YouTube| dcelinkcepeidliddjhapgjokheoldjb  \nAxure RP Viewer| aekfeebhjlmielppjlhebapokdkelion  \nBatch Image Downloader| hnleilhpfbdofpdnnpjggafhncienakg  \nBatch Image Downloader| ibfjnghdeenopfkpbmnkablkfejnlnif  \nBest Speedtest Tool| eklcgjodcnhhcghpbhehhbnmjncbopcg  \nBest YouTube Adblocker| cjjcndlebdepeddfopnhpifmbfecocfh  \nColor Enhancer| bmmchpeggdipgcobjbkcjiifgjdaodng  \nColor by Number| aljmdjbcbkanlhnmcdjbefaomgbekhno  \nColorZilla| mdjeohcdegpfoppocljbccpognjlkjke  \nConvert Everything| ielbkcjohpgmjhoiadncabphkglejgih  \nCool Cursor| ajbkmeegjnmaggkhmibgckapjkohajim  \nCrxMouse - Super Drag| pohfogacehhgefhgmcmnojflfakllkal  \nCrxMouse Gestures| imcbcfmohachfahkbgijokokjpfmoogb  \nCustom New Tab for Edge| dbhgpbaaedlknnnochmkjfacnfnakkfa  \nDownloader for Instagram| higdalghhdbfffdjdiaenminajlmmldb  \nDownload All Images| hnggnhinapdcjocbciajaffnofecfale  \nEdge Web Highlighter| ijgobfhjjipoljjcejmafocdnfnloflm  \nEfficient Adblocker for Youtube| oejbpnadmkdiofacgknaaagbmmonhgpb  \nEnhance YouTube![\u2122](https://s.w.org/images/core/emoji/17.0.2/72x72/2122.png)| jecnjeedhbokmpckobjbgieglfjcomek  \nEvernote in Pinned Tab| elljfaejhdaplocgcejlhfemgimbmcdp  \nFocus To-Do: Pomodoro Timer & To Do List| nlapjaaepfeadiecaipnacimidfjginj  \nFree Online Video Downloader| bpdanoaacmebjgfjdmekfcfgmnaoekim  \nG.B.B.D Translator| fdjpommjpahieenehallhicdhponhacm  \nGIPHY for Edge| gggjlnkbmgmjboipaegjmjmehmcekamo  \nGmail Checker| nhjdhmbdahdidccpobobccagmmijndmp  \nGoogle Hangouts| adnahjjfjjemdiefpobclponnhkijnmo  \nGoogle search link fix| mjofmhcbolkekhebpccldlbdamnfjefc  \nGoogle Translate in Right Click| fcoongackakfdmiincikmjgkedcgjkdp  \nHiddence VPN| akfklmfpgmkkhiiolnfbhalkeccjnmeb  \nHLS Stream Downloader| fgbfcndckldbjifhjgijpjmnpekkelkb  \nIG Downloader for Edge| ncbpkjcnklnbnkjpcamhhoedlkljeolo  \nImage Downloader - Batch Download| ngeoikidkjbegoifbnmfimacmbilfcgi  \nImage Downloader Pro| gnbnbmnldhfoplgjojhepikgjanaplle  \nImageye| ikfdcmchafnmklcndfegdlefcfoaggni  \nImTranslator| bbofakpgfmlfjpjcahodgpbddocpibge  \niQiyi Adblock| hlkenllnegiplhjhpobgangolfkjcgab  \niVideo Downloader| amfboegfahhedgehddflgcfbdaapllfj  \niYouTubeToMP4| bemebcpaekkmffjjbdakpipemmmlgchb  \nLanguage Reactor| hffpfdhdjpbnaddaidajedimmpckekkl  \nLive Start Page| egbkgelnkodaldbpkgjmhcekjakkcpnk  \nMagic Actions for YouTube| pjhoiegecdlpaohfffpajaldpbilngog  \nMarinara: Pomodoro\u00ae Assistant| mebgpfbaibhepnkljpimlijicgkbangk  \nMouse Tooltip Translator| ibjjllhemkfgfbkgohldepcdgiigpdkb  \nNatural Reader Text to Speech| eopjamlpanhfkcbnoeofcnmdfdiogfgl  \nNew Tab - Customized Dashboard| edohfgmjmdnibeihfcajfclmhapjkooa  \nNight Mode| engcfdjknekakgpjkhdobneidcpfbfgm  \nNight Mode| pgcamkdibinodcpkhenjmofbfobpebpn  \nOne Key Translate| jihipmfmicjjpbpmoceapfjmigmemfam  \nPicture-in-Picture Playing| kemjiblbeciejjlgobbkffbpnceieefh  \nPiggy - Automatic Coupons| gmaoimcaoimgmomockloieoifjocpkmf  \nPinterest Save Button| kakgeonhimhojdncehlopejkfaapboeo  \nReturn YouTube Dislike| cgoigjefilgfmcjnnendlpdaonlfoncf  \nRSS Feed| gmciomcaholgmklbfangdjkneihfkddd  \nSave as PDF| mlgefgipndlgdfjfgnjfheigkagjieea  \nSave Pinterest on Right Click| glgbgppjjkldoifgpbhbpbkbcdjpgpfj  \nScreen Shader | Dark Mode| olcibgopfmndlnghnmogcgdhdffdbicg  \nSimilar Sites - Discover Related Websites| fifeankddgioinbcchlokclbcgjlopjj  \nSimilar Sites for Edge| fhhinoefbjlmhakpjohnpabdobgmphli  \nSimple mass downloader| dbhdfkiddhdhmcikjdgblfjbenjfjlfh  \nSocial Book Post Manager| inelenlaldjofeekhjinpjkacjokagke  \nSpeakIt!| badiigfpcpfckbhmpmkhokagppaadkim  \nSpeed Control for Youtube| eindenipbnkpeofhpjjimphfchmjoohe  \nSpell & Grammar Check Tool| fljmegmgjebjdionedkjfgffikhnmcgg  \nssYoutube - Video Downloader| okmfpehbgckbneedidbladdaiekikcdo  \nSummary with ChatGPT| dokiamnhbobapjfhhhcjlfplabeofamp  \nSuper Dark Mode for Edge| lkmeakjjodlkhbikbpdoeicfodaklkna  \nTikMate| jhahljcmjemimhchigiaigklabnpodgo  \nTikTok APP for Edge| celdediiemogjpfcjocdbildilkccepl  \nTikTok Downloader Without Watermark| flcgalphjnojjefjnnimnejbkkefbjgo  \nTo QRcode| cgjomicbgmoadggnjbdiafpjlodmafkp  \nTranskriptor| lplondnihmdhjokafldkcfnjclkhigpm  \nTranslate Officer| jjdfciihihcpgfgmoonfpgglbgclpfai  \nTranslate Selected Text with Google| obocpangfamkffjllmcfnieeoacoheda  \nTranslate Selected Text with Right Click| fmchencccolmmgjmaahfhpglemdcjfll  \nTrusted VPN for Edge - Free VeePN| klmfgbnlbfgpdenpdddpdfigmnkmchil  \nTurbo Download Manager| bpjnmlookdfciblphehedlcbpmignahe  \nTwitch Custom Emotes - FrankerFaceZ| johcbgkljdbebbloakcollpmigpigkpd  \nU-Tube Downloader| nphphgkcccnlmdiihcedabnhfacfmojk  \nUndo Closed Tabs| amemnenomfejhfmfiheekmbcigfkolel  \nUnblock Youku| ajnjfpjimckjhfcpkaldennpdjglmeml  \nUseChatGPT.AI| hcmfdagipflbaagmcnhnhabkmjkopcke  \nVideo & MP3 Downloader| oiolhdeinoaidggfcpebifcbedppbgog  \nVideo Downloader Premium| jgphopeamnghlcekffldkpnbhmiadnbc  \nVPN| pdnjhppcgkdbjolbeplcabkcfmpnbjmh  \nWeather Forecast| hecicojipmfmablnbhknedademofbbpk  \nWebpage Screenshot for Edge| eblienbdkbgiigaebhmljbedkafiobkj  \nYouTube Transcript to Text| nfincgjfplibcdcncfkeehldffppnlnp  \nYouTube![\u2122](https://s.w.org/images/core/emoji/17.0.2/72x72/2122.png) Adblock Plus| flmkfmdmcaepdaoedepihfkhmgopiago  \nYoutube Adblock Online| hmjdegfgppjddmmojloflajkelegnjdp  \nYoutube Download| dhnibdhcanplpdkcljgmfhbipehkgdkk  \nYoutube To MP4 Downloader| cfilkckedhoniijcpjfgihelgepflpni  \nZLibrary Searcher| ffedaeoanbhgmanhhecfjodpopcjnhkc  \n\u4e00\u952e\u7ffb\u8bd1| nepdfkaidpemglngbgpnmmhnleiekpin  \n\u9f20\u6807\u624b\u52bf (Mouse Gestures)| cbopgngpbfeoecnbebghbbhmdadmllce  \n  \n* * *\n\n**We don\u2019t just report on threats\u2014we remove them**\n\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.",
    "published": "2026-06-29T14:41:18",
    "modified": "2026-06-29T14:41:18",
    "type": "malwarebytes",
    "title": "119 Edge extensions promised useful tools, instead downloaded malware",
    "source": "",
    "references": "",
    "id": "MALWAREBYTES:5E2D00C93323F5A75AF36EF6CFB363CE",
    "bulletinFamily": "blog",
    "cwe": null,
    "cvelist": [],
    "sourceData": "",
    "sourceHref": "",
    "cvss": {
        "score": 0,
        "severity": "NONE",
        "vector": "NONE",
        "version": "NONE"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "https://www.malwarebytes.com/blog/news/2026/06/119-edge-extensions-promised-useful-tools-instead-downloaded-malware",
    "category_name": "News",
    "post_link": "",
    "product": "",
    "version": "",
    "vendor": "",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}