Microsoft finds 250 browser extensions linked to tracking campaign

The investigation identified at least 250 related listings across Microsoft Edge Add-ons, the Chrome Web Store, and Mozilla Add-ons that posed as maps, recipe finders, package trackers, and other everyday utilities.

Microsoft’s Edge Extensions Security Team explained that the extensions behaved differently depending on how users reached their store listings, helping conceal their unwanted functionality during reviews. Researchers connected the family by correlating extension metadata, infrastructure, and observed behavior.

The campaign exploited official browser extension marketplaces, where submissions undergo checks for harmful or deceptive behavior. Most SleeperWidget extensions also delivered their advertised features, making their additional activities less obvious.

Ads unlock hidden behavior

After installation, the extension opened another page on the campaign’s domain. Its content script retrieved the previously stored activation data and copied it into extension storage.

That ticket distinguished advertising-driven installations from direct store downloads. Without it, the extension supplied its advertised widget without contacting the command server. With it, the extension could enter the hidden workflow, subject to a separate server-controlled activation setting.

The analyzed extension used Manifest V3, which restricts remotely hosted executable code. SleeperWidget avoided that restriction by bundling its executable components inside the reviewed package and supplying activation data separately.

Its page.js content script had access to HTTP and HTTPS pages, while the sw.js service worker handled reporting and server responses.

Tracking continues after ads are disabled

Once activated, the extension transmitted full page addresses and titles, potentially exposing queries, alongside tab identifiers, focus status, and window state.

The server could return destinations for the extension to open, generating unsolicited advertising tabs and shopping redirects containing the operator’s affiliate tags.

Microsoft observed advertising and affiliate destinations during testing. However, the extension did not validate the returned URLs, leaving the same mechanism able to direct users to phishing or malware pages.

Turning off the extension’s “ content” setting stopped visible ad injection but left browsing surveillance running, with page addresses and titles still transmitted on each .

Related extensions also shared a persistent user identifier. Microsoft confirmed that View Point 3D Earth and Free Digital Books Online stored the same identifier despite using different campaign domains, allowing activity across extensions to be linked. Removing one extension left identifiers held by other installed family members intact.

Microsoft began enforcement in April 2026, removing identified Edge listings and applying revocations as additional members emerged. It shared indicators with Google and Mozilla, but the report does not confirm equivalent removals from their stores.

Edge protections placed more than one million associated client identifiers into a malware-blocked state.

Users should check the list of malicious extensions and remove them immediately.