19 Browser Extensions Turned Into Data-Stealing Malware After Developers Sold Them

• The Mess: Researchers found 19 Chrome and Edge extensions containing malicious functionality, including extensions that were legitimate before changing hands and later receiving code designed to steal browser data.
• The Damage: Users can install an extension that looks legitimate while quietly exposing cookies, credentials, cryptocurrency data and browsing information to attackers.
• The Fix: Remove the affected extensions, revoke active browser sessions and credentials, and treat any account accessed from a compromised browser profile as potentially exposed.

Your browser extension doesn’t need to be malicious on day one.

Someone can simply buy it.

Then change the code.

That’s the ugly part of a new browser-extension campaign uncovered by security researchers.

A collection of 19 Chrome and Edge extensions was found carrying malicious functionality. Several had an interesting history: they were previously legitimate projects and were later acquired or transferred before the malicious code appeared.

The attack didn’t need to convince users to install something called:

DefinitelyNotMalware.exe

It used software that already looked trustworthy.

The Developer Changed. The Extension Changed With It.

This is a classic supply-chain problem.

An extension has:

• reviews
• users
• downloads
• an established name
• a legitimate developer history

Then ownership changes.

The new owner publishes an update.

Users install it because browsers make updates largely invisible.

The trusted extension becomes the delivery mechanism.

That’s much more effective than starting a brand-new extension with zero reputation.

19 Extensions Were Identified

Researchers identified 19 extensions across Chrome and Edge.

The affected extensions were capable of collecting sensitive browser information and communicating with attacker-controlled infrastructure.

Some of the extensions had accumulated substantial installation numbers.

The largest reportedly had tens of thousands of users, making the campaign considerably more interesting than an isolated malicious extension with a handful of victims.

The exact capabilities varied between extensions.

Potentially exposed information included:

• browsing data
• cookies
• authentication information
• credentials
• cryptocurrency-related data
• information stored by web applications

Cookies Can Be More Valuable Than Passwords

Users often assume changing their password solves everything.

Not necessarily.

If an attacker obtains a valid session cookie, they may be able to access an account without knowing the password.

That can turn a browser extension compromise into an account-takeover problem.

The attacker doesn’t have to guess:

username + password

They may already possess:

authenticated session

That is why simply removing the extension isn’t enough.

Existing sessions should be revoked.

Cryptocurrency Users Have Another Problem

Browser extensions interact directly with web applications.

That makes them particularly attractive targets for cryptocurrency users.

A malicious extension can potentially monitor pages, manipulate web content or attempt to capture information associated with wallet activity.

The browser is where the user interacts with the wallet.

Compromise the browser environment and the wallet interaction itself becomes suspect.

Users should therefore treat cryptocurrency activity performed from an affected browser profile as potentially compromised.

The Most Interesting Part Is the Ownership Transfer

The malicious-code discovery is important.

The ownership history is even more interesting.

Security teams have spent years warning about software supply chains.

Most discussions focus on:

• package repositories
• CI/CD
• stolen signing keys
• compromised developers
• malicious dependencies

Browser extensions deserve the same scrutiny.

An extension already has privileged access to parts of the browser.

Depending on its permissions, it can observe pages, access storage, communicate with remote servers and modify content.

Giving those permissions to a newly acquired developer is effectively handing over a small piece of the user’s browser.

Users Usually Don’t Re-Evaluate Permissions

That’s the attacker’s advantage.

The extension is already installed.

The user already trusted it.

The browser updates it automatically.

There may be no obvious moment where the victim makes a new security decision.

A legitimate extension from three years ago can become a malicious extension today.

The user doesn’t have to click anything.

The update mechanism does the work.

Chrome Web Store Approval Isn’t a Security Guarantee

Being available through an official extension store is useful.

It isn’t a mathematical guarantee that the code is safe forever.

Extensions change.

Developers change.

Permissions change.

Backend infrastructure changes.

Malicious functionality can also be introduced after an extension has established a legitimate reputation.

That means users should pay attention to major changes in:

• publisher
• permissions
• extension behavior
• update history
• privacy policy
• network activity

Especially when an extension suddenly requests permissions that make no sense for its original purpose.

What Administrators Should Check

For organizations, browser extensions deserve the same attention as endpoint software.

Security teams should inventory:

• installed extensions
• extension IDs
• publisher accounts
• requested permissions
• installed versions
• update dates
• browser policies

Enterprise-managed Chrome and Edge environments can enforce extension allowlists.

That’s often a better strategy than allowing employees to install anything they find useful.

Because “useful” is exactly what attackers want their malware to look like.

Removing the Extension Is Step One

If an affected extension was installed, remove it.

Then assume the browser profile may have been exposed.

Review:

• active sessions
• Google/Microsoft accounts
• corporate SaaS
• GitHub
• cloud consoles
• password managers
• cryptocurrency services
• email accounts

Revoke sessions where possible.

Rotate credentials that may have been accessible.

For high-value accounts, investigate login history and token activity.

Developers Are Especially Attractive Targets

A browser extension running on a developer’s workstation can be significantly more valuable than one running on an ordinary home PC.

Developers may have authenticated sessions to:

• GitHub
• GitLab
• AWS
• Azure
• Google Cloud
• npm
• Docker Hub
• package registries
• internal dashboards

One stolen browser session can therefore become a supply-chain incident.

The attacker doesn’t need to exploit the production server.

They can steal the developer’s access first.

This Is Why “It Has 50,000 Users” Means Nothing

A large user base proves popularity.

It doesn’t prove security.

In fact, from an attacker’s perspective, popularity is the attraction.

A malicious new extension has to earn trust.

A compromised established extension already has it.

That’s a much better business model for malware distribution.

The Browser Has Become an Operating Environment

Modern browsers aren’t simple document viewers.

They contain:

• passwords
• sessions
• tokens
• financial applications
• corporate SaaS
• developer tools
• cryptocurrency wallets
• personal data

Extensions can interact with that environment.

That’s why extension security deserves the same level of suspicion as installed desktop software.

Bugstoday Opinion

The most disturbing part of this story isn’t that researchers found malicious browser extensions.

That’s old news.

It’s that trust can be transferred along with ownership.

Users trusted the developer.

Then the developer changed.

The extension changed.

The users didn’t.

And that’s enough.

Bugstoday verdict: an extension doesn’t need to start as malware to become an excellent malware delivery mechanism. If you install browser extensions simply because they’ve been around for years and have thousands of users, you’re trusting history instead of code. Audit what is installed, remove unnecessary extensions and treat ownership changes as a security event — not a marketing detail.

Today’s Bugs. Tomorrow’s Breaches.

Sources

• Socket — Malicious Chrome and Edge Extensions Research
• Chrome Web Store — Extension Listings and Developer Information
• Microsoft Edge Add-ons — Extension Listings
• Google Chrome Enterprise — Extension Management
• Microsoft Security — Browser Security Guidance