Adware Stages Comeback Via Browser Extensions
Summary: The Wikimedia Foundation warned that readers seeing ads on Wikipedia articles likely have a browser infected with malware, pointing to a resurgence of adware and spyware delivered through disguised browser extensions. The post named the "IWantThis!" extension, which Kaspersky Lab's Sergey Golovanov said had been delivered via the Crossrider platform since at least February 2012, and which none of the 43 antivirus and security applications used in a Virustotal scan flagged as malicious or even a potentially unwanted application.
Why it matters: A single extension that collects IP addresses, logins, email addresses, passwords and full URL clickstreams passed a 43-engine Virustotal scan without a single detection, so an endpoint agent returning clean is not evidence that a browser extension is safe.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026