[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fULVLb4yfNYSWl8p5QUB-wqedFopgaLzunU62Q0_fQWI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"62676682-215f-4cd9-86a4-d9910126464f","119-malicious-edge-extensions-used-steganography-to-steal-credentials-from-26m-users","1ed8b57b-2388-43c0-89bc-1c5f429e553b","119 Malicious Edge Extensions Used Steganography to Steal Credentials from 2.6M Users","Microsoft removed 119 malicious browser extensions from the Edge Add-ons store that had been active since at least 2021, reaching up to 2.6 million users before detection. These extensions exploited steganography — hiding malicious code inside image and font files — to evade traditional signature-based detection tools, making them particularly difficult to identify. Once installed, they performed ad fraud and harvested credentials from services like Google and WordPress. This incident highlights the dangers of treating official browser extension stores as inherently trustworthy, and underscores how sophisticated obfuscation techniques can allow malware to persist undetected for years. Organizations and end users alike must apply the same scrutiny to browser extensions as they would to any third-party software.","**Immediate actions:**\n- Audit all browser extensions currently installed across organizational endpoints and remove any that are unverified or unnecessary.\n- Block or restrict installation of browser extensions via Group Policy or endpoint management tools until extensions have been reviewed and approved.\n\n**Long-term improvements:**\n- Establish and enforce a browser extension allowlist policy, permitting only vetted, business-justified extensions in corporate environments.\n- Treat browser extensions as third-party supply chain software and include them in your vendor\u002Fsoftware risk assessment processes.\n- Deploy Content Security Policy (CSP) and endpoint detection tools capable of identifying anomalous browser behavior, including steganographic payload delivery.\n\n**Detection measures:**\n- Monitor endpoint telemetry for unusual network traffic patterns originating from browser processes, which may indicate ad fraud or credential exfiltration.\n- Implement threat intelligence feeds that include malicious extension indicators of compromise (IOCs) to enable faster detection of known-bad extensions.",[12,13,14,15,16,17,18,19,20],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-12: Supply Chain Protection","NIST CSF DE.CM-4: Malicious Code Detection","GDPR Article 32: Security of Processing (credential theft impacts personal data)","MITRE ATT&CK T1027: Obfuscated Files or Information (Steganography)","MITRE ATT&CK T1176: Browser Extensions",{},"published","2026-06-29T10:21:07.383153+00:00","2026-06-29T10:21:07.233+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fmicrosoft-removes-119-edge-extensions.html","microsoft-removes-119-edge-extensions-that-hid-malware-in-images-and-fonts-671818","Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":43,"name":44,"slug":45,"description":46,"color":47},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[50,53,57],{"slug":33,"name":51,"problem":52},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees."]