119 Malicious Edge Extensions Used Steganography to Steal Credentials from 2.6M Users
Written by AI from the linked story. Not reviewed by an editor. How this works
Microsoft removed 119 malicious browser extensions from the Edge Add-ons store that had been active since at least 2021, reaching up to 2.6 million users before detection. These extensions exploited steganography — hiding malicious code inside image and font files — to evade traditional signature-based detection tools, making them particularly difficult to identify. Once installed, they performed ad fraud and harvested credentials from services like Google and WordPress. This incident highlights the dangers of treating official browser extension stores as inherently trustworthy, and underscores how sophisticated obfuscation techniques can allow malware to persist undetected for years. Organizations and end users alike must apply the same scrutiny to browser extensions as they would to any third-party software.
Tactical Insight
Immediate actions
- Audit all browser extensions currently installed across organizational endpoints and remove any that are unverified or unnecessary.
- Block or restrict installation of browser extensions via Group Policy or endpoint management tools until extensions have been reviewed and approved.
Long-term improvements
- Establish and enforce a browser extension allowlist policy, permitting only vetted, business-justified extensions in corporate environments.
- Treat browser extensions as third-party supply chain software and include them in your vendor/software risk assessment processes.
- Deploy Content Security Policy (CSP) and endpoint detection tools capable of identifying anomalous browser behavior, including steganographic payload delivery.
Detection measures
- Monitor endpoint telemetry for unusual network traffic patterns originating from browser processes, which may indicate ad fraud or credential exfiltration.
- Implement threat intelligence feeds that include malicious extension indicators of compromise (IOCs) to enable faster detection of known-bad extensions.