Shady Panda: The Silent Browser Takeover Threat and How Qualys Tru Risk Eliminate Helps You Stop It | Qualys
Summary: ShadyPanda has run long-term browser supply chain attacks since 2018, publishing seemingly harmless extensions such as wallpapers, utilities, and new-tab tools to build installation counts and trusted marketplace status, then weaponizing them through updates that delivered remote code execution backdoors and spyware. Extensions including Clean Master were operated legitimately for years across Chrome and Edge, and researchers estimate more than 4.3 million users across both browsers were affected.
Key Takeaway: The campaign relied on no CVE and no zero-day, so vulnerability scanning alone would not have flagged it - the malicious capability arrived through a routine update to software users already trusted, and the same access lets attackers profile users, hijack sessions, and potentially infiltrate enterprise environments.
Read the original at Qualys Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026