[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9Z-ojtUdXYvyeon73E_yJeQKUe4R3YZyKXaY3VBpdZA":3},{"article":4,"iocs":41,"watch_terms":45,"solutions":46,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"1ed8b57b-2388-43c0-89bc-1c5f429e553b","Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts","microsoft-removes-119-edge-extensions-that-hid-malware-in-images-and-fonts-671818","Microsoft has shut down a long-running malicious extension operation on the Edge Add-ons store that hid its payloads inside ordinary image and font files, then woke up days after install to steal credentials and run ad fraud. The company calls it StegoAd, a mash-up of steganography and adware, and ties 119 extensions to a single threat actor it says has been active since at least 2021.","Microsoft has taken down 119 malicious extensions from the Edge Add-ons store that used steganography to hide malware within image and font files. These extensions, active since at least 2021 and installed by up to 2.6 million users, performed ad fraud and stole credentials, including Google and WordPress logins, before being detected and removed.","Microsoft removes 119 malicious Edge extensions hiding malware in images and fonts.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fmicrosoft-removes-119-edge-extensions.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhmbNHaJMqOcEeoUkaQeIZC_ilbUt8RpG-kyweNVY_fJ_3BQk19-pmJQXV_soXqZiHleBISNTwcYSqew2nzpc3eBEDULz52KaY1RNrJTb7u87f2oEtpJuTtmi4OL6Lc_HXP9WQcMDRco_w4U5mklzQ1QJj8ndNiBYVQRRUsevzc1P6hZe2N26_lyAhkQbsP\u002Fs1600\u002Fedge.jpg","2026-06-29T08:32:31+00:00","2026-06-29T10:00:12.225739+00:00",8,[17,20,23,26],{"name":18,"type":19},"Edge","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Steganography","technology",{"name":27,"type":25},"Adware","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,36],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":32,"value":43,"context":44},"StegoAd","Name given by Microsoft to the malicious extension operation",[21],{"controls":47,"vendors":134},[48,77,105],{"slug":49,"name":50,"problem":51,"products":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":78,"name":79,"problem":80,"products":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[82,90,97],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":91,"vendor_name":21,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":106,"name":107,"problem":108,"products":109},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",[135],{"slug":91,"name":21,"logo_path":92,"roles":136},[137],"affected",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":152},"119-malicious-edge-extensions-used-steganography-to-steal-credentials-from-26m-users","119 Malicious Edge Extensions Used Steganography to Steal Credentials from 2.6M Users","Microsoft removed 119 malicious browser extensions from the Edge Add-ons store that had been active since at least 2021, reaching up to 2.6 million users before detection. These extensions exploited steganography — hiding malicious code inside image and font files — to evade traditional signature-based detection tools, making them particularly difficult to identify. Once installed, they performed ad fraud and harvested credentials from services like Google and WordPress. This incident highlights the dangers of treating official browser extension stores as inherently trustworthy, and underscores how sophisticated obfuscation techniques can allow malware to persist undetected for years. Organizations and end users alike must apply the same scrutiny to browser extensions as they would to any third-party software.",[143,144,145,146,147,148,149,150,151],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-12: Supply Chain Protection","NIST CSF DE.CM-4: Malicious Code Detection","GDPR Article 32: Security of Processing (credential theft impacts personal data)","MITRE ATT&CK T1027: Obfuscated Files or Information (Steganography)","MITRE ATT&CK T1176: Browser Extensions",{}]