Malicious browser extensions sometimes slip into official marketplaces like the Chrome Web Store by disguising themselves as genuine tools. Detecting them becomes even harder when they behave legitimately at first, only turning harmful after users have grown to trust them.
This tactic was recently uncovered on Google Chrome and Microsoft Edge. Researchers at Koi Security discovered several extensions on both platforms that functioned normally for years before being updated with malicious code. These updates enabled attackers to monitor user activity, collect sensitive information, and secretly send that data to external servers. The operation, dubbed ShadyPanda, amassed nearly four million downloads and continues to remain active on Edge.
Earlier this year, threat actors used a similar approach on Firefox. They first released harmless extensions designed to imitate popular cryptocurrency wallets. After gaining approval, downloads, and positive reviews, they later injected malicious functionality that logged user inputs in form fields, allowing attackers to access and steal crypto assets.
According to Koi Security, ShadyPanda originally began as an affiliate fraud scheme. Around 145 extensions posing as wallpaper and productivity tools were published across Chrome and Edge. In the initial phase, these add-ons inserted affiliate tracking codes and generated commission-based revenue through clicks to platforms like eBay, Amazon, and Booking.com. Over time, the campaign escalated to manipulating search results and eventually narrowed down to five extensions launched in 2018 that were later transformed into malware.
Some of these extensions gained significant credibility. They were labeled as Featured and Verified on Chrome, and one cache-cleaning tool called Clean Master achieved a 4.8-star rating from thousands of users. In 2024, updates to these extensions introduced malware capable of checking in hourly for commands, maintaining complete browser access, and transmitting user data back to ShadyPanda-controlled servers. These extensions have since been removed from Chrome.
In 2023, attackers also introduced five additional extensions to Microsoft Edge, including one called WeTab. Two of these functioned as full-scale spyware, and all remained active at the time of Koi Security’s report.
Because malicious extensions often masquerade as legitimate ones, simply scanning your installed add-ons may not reveal any obvious threats. Koi Security has published a list of extension IDs linked to the ShadyPanda campaign, which users should manually check.
On Chrome, users can enter chrome://extensions/ in the address bar, enable Developer mode, and view the IDs of installed extensions. These IDs can then be searched individually using the browser’s find function. If none match the listed malicious IDs, the browser is likely safe. If a match is found, the extension should be removed immediately. Edge users can follow the same steps via edge://extensions/.
This campaign highlights that even long-installed extensions can later be weaponized. Users should apply the same caution to browser add-ons as they do to mobile or desktop apps. Carefully review extension names, as fake ones often closely resemble legitimate tools. Watch for spelling errors, mismatched descriptions or images, and suspicious review patterns, such as an unusually high number of positive ratings in a short time. Conducting additional checks through online searches or community forums like Reddit can also help verify whether an extension is trustworthy.