A Browser Extension Risk Guide After the Shady Panda Campaign
Summary: Security researchers in early December 2025 exposed ShadyPanda, a threat group that spent seven years publishing or acquiring harmless Chrome and Edge extensions, letting them run clean to build trust and millions of installs, then flipping them to spyware and backdoors through silent automatic updates. About 4.3 million users had installed the add-ons, some of which carried featured and verified badges in the Chrome Web Store and Microsoft Edge Add-ons site, and once activated in mid-2024 they ran as a remote code execution framework in the browser that could monitor URLs and keystrokes, inject scripts, and steal session cookies and tokens.
Key Takeaway: Session token theft let the extensions impersonate authenticated SaaS accounts such as Microsoft 365 and Google Workspace without tripping MFA, because the browser session was already authenticated. Millions of stolen session tokens could have opened enterprise email, files, and chat messages without triggering the usual security alarms.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026