{“lastseen”:”2025-12-02T18:05:12″,”description”:”Researchers have unraveled a malware campaign that really did play the long game. After seven years of behaving normally, a set of browser extensions installed on roughly 4.3 million Chrome and Edge users\u2019 devices suddenly went rogue. Now they can track what you browse and run malicious code inside your browser.\\n\\nThe researchers found five extensions that operated cleanly for years before being weaponized in mid-2024. The developers earned trust, built up millions of installs, and even collected \u201cFeatured\u201d or \u201cVerified\u201d status in the Chrome and Edge stores. Then they pushed silent updates that turned these add-ons into spyware and malware.\\n\\nThe extensions turned into a remote code execution framework. They could download and run malicious JavaScript inside the browser and collect information about visited sites and the user\u2019s browser, sending it all back to attackers believed to be based in China.\\n\\nOne of the most prevalent of these extensions is WeTab, with around three million installs on Edge. It acts as spyware by streaming visited URLs, search queries, and other data in real time. The researchers note that while Google has removed the extensions, the Edge store versions are still available.\\n\\nPlaying the long game is not something cybercriminals usually have the time or patience for. \\n\\nThe researchers attributed the campaign to the ShadyPanda group, which has been active since at least 2018 and launched their first campaign in 2023. That was a simpler case of affiliate fraud, inserting affiliate tracking codes into users’ shopping clicks.\\n\\nWhat the group did learn from that campaign was that they could get away with deploying malicious updates to existing extensions. Google vets new extensions carefully, but updates don\u2019t get the same attention. \\n\\nIt’s not the first time we’ve seen this behavior, but waiting for years is exceptional. When an extension has been available in the web store for a while, cybercriminals can insert malicious code through updates to the extension. Some researchers refer to the clean extensions as \u201csleeper agents\u201d that sit quietly for years before switching to malicious behavior.\\n\\nThis new campaign is far more dangerous. Every infected browser runs a remote code execution framework. Every hour, it checks `api.extensionplay[.]com` for new instructions, downloads arbitrary JavaScript, and executes it with full browser API access.\\n\\n## How to find malicious extensions manually\\n\\nThe researchers at Koi shared a long list of Chrome and Edge extension IDs linked to this campaign. You can check if you have these extensions in your browser:\\n\\n**In Chrome**\\n\\n 1. Open Google Chrome.\\n 2. In the address bar at the top, type **chrome:\/\/extensions\/** and press **Enter**.\u200b This opens the Extensions page, which shows all extensions installed in your browser.\u200b\\n 3. At the top right of this page, turn on **Developer mode**.\\n 4. Now each extension card will show an extra line with its **ID.** \u200b\\n 5. Press **Ctrl+F** (or **Cmd+F** on Mac) to open the search box and paste the ID you\u2019re checking (e.g. `eagiakjmjnblliacokhcalebgnhellfi`) into the search box.\\n\\n\\n\\nIf the page scrolls to an extension and highlights the ID, it’s installed. If it says _No results found_ , it isn’t in that Chrome profile.\u200b\\n\\nIf you see that ID under an extension, it means that particular add\u2011on is installed for the current Chrome profile.\u200b\\n\\nTo remove it, click **Remove** on that extension\u2019s card on the same page.\\n\\n**In Edge**\\n\\nSince Edge is a Chromium browser the steps are the same, just go to **edge:\/\/extensions\/** instead.\\n\\n* * *\\n\\n**We don\u2019t just report on threats\u2014we remove them**\\n\\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.”,”published”:”2025-12-02T17:49:51″,”modified”:”2025-12-02T17:49:51″,”type”:”malwarebytes”,”title”:”\u201cSleeper\u201d browser extensions woke up as spyware on 4 million devices”,”source”:””,”references”:””,”id”:”MALWAREBYTES:4BFBE49E7F19305A106D3508B5630C06″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2025\/12\/sleeper-browser-extensions-woke-up-as-spyware-on-4-million-devices”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-02T18:05:12″,”description”:”Researchers have unraveled a malware campaign that really did play the long game. After seven years of behaving normally, a set of browser extensions installed…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-28295","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n