STEALTHY BROWSER EXTENSIONS WAITED YEARS BEFORE INFECTING 4.3M CHROME, EDGE USERS WITH BACKDOORS AND SPYWARE

Summary from the TLDR InfoSec newsletter

ShadyPanda, a threat actor, compromised 4.3 million Chrome and Edge users through a seven-year campaign that published legitimate extensions, accumulated Featured and Verified status, and then weaponized them via malicious updates containing backdoors and spyware. The malware enabled complete browser surveillance, with remote code execution capabilities, hourly C2 communication to a server, arbitrary JavaScript execution with full browser API access, and real-time exfiltration of browsing data. ShadyPanda exploited the fundamental gap that allows marketplaces to review extensions only at submission, rather than monitor post-approval updates. Five extensions with over 4 million combined installs remain active on the Edge marketplace.