Back Redmondmag

Microsoft Disrupts StegoAd Extension Campaign Affecting Up to 2.6 Million Users

Redmondmag • June 29, 2026

Microsoft has disrupted a large malicious browser extension campaign that used hidden payloads, delayed execution and disposable developer accounts to evade detection while targeting users with ad fraud, credential theft and remote code execution capabilities.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Disrupts StegoAd Campaign with Malicious Edge Extensions Microsoft has dismantled the StegoAd operation, removing 119 malicious Edge extensions that used steganography to hide malware within image and font files. The campaign, active since 2021, targeted over 2.6 million users, employing techniques like remote code execution and time-delayed payload activation. The extensions masqueraded as legitimate tools, including ad blockers and VPNs, while executing credential theft and ad fraud. Microsoft confirmed that the threat actors demonstrated advanced evasion techniques, including fingerprint checks for payload delivery. The takedown highlights the ongoing risks associated with browser extensions that request access to user data. Users are advised to review their installed extensions and change passwords if affected. The full list of malicious extensions is available in a detailed report by Microsoft. 9 sources 69

Extracted Entities

Microsoft Disrupts StegoAd Extension Campaign Affecting Up to 2.6 Million Users

The full story

Extracted Entities

Attack Types (1)

Campaigns (2)

MITRE ATT&CK (1)