Back Feeds.4Sysops

Microsoft removes 119 Edge extensions hiding malware in images and fonts

Feeds.4Sysops •IT News • June 29, 2026

Microsoft has dismantled a sophisticated browser threat operation dubbed StegoAd that utilized 119 malicious extensions in the Edge Add-ons store. The campaign leveraged steganography to conceal malicious JavaScript within seemingly harmless PNG, WebP, and WOFF2 font files. These extensions remained dormant for three to five days after installation to bypass initial security screenings and avoid immediate user suspicion. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Disrupts StegoAd Campaign with Malicious Edge Extensions Microsoft has dismantled the StegoAd operation, removing 119 malicious Edge extensions that used steganography to hide malware within image and font files. The campaign, active since 2021, targeted over 2.6 million users, employing techniques like remote code execution and time-delayed payload activation. The extensions masqueraded as legitimate tools, including ad blockers and VPNs, while executing credential theft and ad fraud. Microsoft confirmed that the threat actors demonstrated advanced evasion techniques, including fingerprint checks for payload delivery. The takedown highlights the ongoing risks associated with browser extensions that request access to user data. Users are advised to review their installed extensions and change passwords if affected. The full list of malicious extensions is available in a detailed report by Microsoft. 9 sources 69

Extracted Entities

Microsoft removes 119 Edge extensions hiding malware in images and fonts

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (1)