🐼 ShadyPanda’s Seven-Year Sleep: 4.3 Million Users Targeted by Malicious Browser Extensions
Cybersecurity researchers at Koi Security have uncovered a massive, long-running campaign by a threat actor known as ShadyPanda. Over seven years, this group infiltrated Chrome and Edge browsers through seemingly harmless extensions, amassing 4.3 million installs before deploying spyware and backdoors.
Phase 1: Building Trust (2018–2022)
ShadyPanda began publishing extensions in Google Chrome and in Firefox under innocent themes—wallpaper managers, productivity tools—earning glowing reviews and “Featured” badges. This strategy built credibility and lulled users into a false sense of security. ShadyPanda had been producing viable, sought after product for 4 years! Credibility is everything nowadays.
Phase 2: Affiliate Fraud (2023)
The first malicious activity appeared in 2023: silent affiliate code injection. Users shopping on Amazon, eBay, or Booking.com unknowingly generated revenue for ShadyPanda through hidden tracking snippets. This phase acted as a low-risk smokescreen. Making revenue but, not the ultimate goal of the malware.
Phase 3: Search Hijacking & Cookie Theft (Early 2024)
By early 2024, extensions began redirecting searches to hijacked engines like trovi.com, harvesting queries and session cookies. These updates were stealthy and short-lived, but they marked a clear escalation.
Phase 4: Full-Scale Spyware & Backdoors (Mid-2024 to Present)
The most dangerous phase started mid-2024. Popular extensions like Clean Master (200k+ installs) received updates embedding remote code execution (RCE) backdoors. These allowed ShadyPanda to inject malicious JavaScript hourly, enabling:
- URL logging
- Search term capture
- Mouse click and scroll tracking
- Cookie and session data exfiltration
Meanwhile, Edge extensions like WeTab (3M+ installs) streamed browsing activity directly to servers in China.
Oh boy huh? How much crap does the US have to take from WEST TAIWAN anyway??
ShadyPanda’s Seven-Year Sleep
How ShadyPanda Evaded Detection
ShadyPanda’s stealth relied on exploiting systemic weaknesses:
- Legitimate Beginnings – Innocent features and positive reviews built trust.
- Delayed Malicious Updates – Years passed before harmful code appeared.
- Auto-Update Exploitation – Silent updates injected malware without user consent.
- Dynamic Payload Delivery – Malicious scripts fetched hourly, evading static scans.
- Developer Tools Cloaking – Extensions behaved normally when inspected manually.
- Affiliate Fraud as a Smokescreen – Early low-risk tactics normalized suspicious traffic.
- Marketplace Oversight Gaps – Stores vet submissions once but rarely monitor updates.
Why It Worked: Marketplace Blind Spots
Browser extension marketplaces review new submissions but rarely monitor updates. ShadyPanda exploited this one-time vetting model, using auto-updates to slip malicious code into trusted extensions.
What You Should Do Now
✅ Audit Your Extensions
- Chrome:
chrome://extensions/ - Edge:
edge://extensions/
Look for suspicious names like Clean Master, Infinity V+, WeTab, or anything from “Starlab Technology.”
✂️ Remove Anything Unfamiliar
Uninstall questionable extensions immediately.
🔐 Rotate Credentials
Reset passwords and re-authenticate accounts—cookies and tokens may have been stolen.
🛡 Adopt a Security Mindset
- Prefer open-source or well-documented extensions.
- Audit monthly.
- Use endpoint protection that flags suspicious browser behavior.
The Bottom Line
Over 4.3 million users may have been exposed to spyware, session hijacking, and data theft. This campaign proves that trust in browser extensions isn’t permanent—and that vigilance is essential.
I am the Nerd of Fortune. I have been hustling from home (part-time) for about 15 years & working exclusively from home for several years – and loving it! I am a firm believer in making ‘working from home’ a success for everyone…
