Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts

Microsoft removed 119 malicious browser extensions from the Edge Add-ons store that had been active since at least 2021, reaching up to 2.6 million users before detection. These extensions exploited steganography — hiding malicious code inside image and font files — to evade traditional signature-based detection tools, making them particularly difficult to identify. Once installed, they performed ad fraud and harvested credentials from services like Google and WordPress. This incident highlights the dangers of treating official browser extension stores as inherently trustworthy, and underscores how sophisticated obfuscation techniques can allow malware to persist undetected for years. Organizations and end users alike must apply the same scrutiny to browser extensions as they would to any third-party software.