Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts
Summary: Microsoft removed 119 Edge Add-ons store extensions tied to a single threat actor active since at least 2021, a campaign it calls StegoAd because payloads were hidden inside image and font files via steganography. The extensions - ad blockers, VPNs, translators, video downloaders - had a combined install base of up to 2.6 million users, and Microsoft suspended the 90-plus developer accounts behind them.
What you should know: The 2.6 million figure is a ceiling, not a victim count, and Microsoft says how many people were actually compromised is not known - while the payloads stole Google credentials and second-factor codes at sign-in, harvested WordPress admin logins, and exfiltrated cookies in bulk. Microsoft also says the operator is still active.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026