Back Technadu

Microsoft Removes Over 100 StegoAd Edge Extensions Hiding Malware via Steganography

Technadu • June 29, 2026

Microsoft has removed 119 Edge browser extensions that concealed malware payloads inside image and font files, part of a campaign tracked as StegoAd. The extensions used steganography to embed malicious payloads within image and font files. The operators also relied on polymorphism, remote code execution (RCE) backdoors, and time-delayed activation.

According to the company’s report, the extensions pursued two distinct malicious goals. First, they were built to steal credentials, exposing affected users to account compromise. Second, they carried out ad fraud, generating illicit revenue for the operators behind the campaign.

The report notes that the campaign’s use of image- and font-based steganography to deliver executable payloads is a technique rarely seen at this scale in the browser extension ecosystem. StegoAd is a monetization and credential theft platform at its core that protects a multi-layered revenue and data theft engine:

The combination of data theft and fraudulent ad activity reflects a financially motivated operation leveraging the trust users place in browser add-ons.

Microsoft removed all the malicious extensions from its Edge platform after the StegoAd activity was identified. The takedown underscores the persistent risk posed by extensions that request access to browsing activity and can deliver hidden code at scale.

The incident reinforces the need to scrutinize extension behavior beyond its stated functionality, particularly where image and font files can serve as carriers of concealed payloads. Steganography was also used in a global Caminho Loader campaign seen in October, which deployed Remcos RAT, XWorm, and Katz Stealer.

In other recent news, browser security company Island found last week that the Adblock for YouTube Chrome extension hides dormant JavaScript injection. A LayerX report in February found that malicious Chrome extensions exploit the popularity of AI.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Disrupts StegoAd Campaign with Malicious Edge Extensions Microsoft has dismantled the StegoAd operation, removing 119 malicious Edge extensions that used steganography to hide malware within image and font files. The campaign, active since 2021, targeted over 2.6 million users, employing techniques like remote code execution and time-delayed payload activation. The extensions masqueraded as legitimate tools, including ad blockers and VPNs, while executing credential theft and ad fraud. Microsoft confirmed that the threat actors demonstrated advanced evasion techniques, including fingerprint checks for payload delivery. The takedown highlights the ongoing risks associated with browser extensions that request access to user data. Users are advised to review their installed extensions and change passwords if affected. The full list of malicious extensions is available in a detailed report by Microsoft. 13 sources 69

Extracted Entities

Microsoft Removes Over 100 StegoAd Edge Extensions Hiding Malware via Steganography

The full story

Extracted Entities

Attack Types (1)

Campaigns (2)

Companies (1)

Malware (3)

Platforms (1)

Tools (1)