ShadyPanda's Seven

Infosecurity-Magazine • December 2, 2025

A seven-year browser extension campaign has infected 4.3 million Chrome and Edge users.

The group responsible, tracked as ShadyPanda, has been observed leveraging trusted browser marketplaces to build user bases, operate legitimately for years, then quietly deploy malicious updates.

A new Koi Security report identified a remote code execution backdoor affecting 300,000 users across five extensions, including Clean Master.

These extensions had operated normally since 2018, until a mid-2024 update enabled hourly downloads of arbitrary JavaScript. The malware logged website visits, exfiltrated encrypted browsing histories and gathered full browser fingerprints.

Meanwhile, a parallel spyware operation reached more than 4 million users through five additional Microsoft Edge extensions, most notably WeTab, which alone accounted for 3 million installs.

These extensions collected every URL visited, term, mouse click and various browser identifiers, with traffic routed to servers in China.

ShadyPanda's earliest efforts date back to 2023, when the threat actor launched 145 browser extensions masquerading as wallpaper or productivity tools.

These add-ons injected affiliate codes on several shopping sites and used Google Analytics to profile user behavior. Koi researchers said the campaign revealed three lessons ShadyPanda would later exploit:

Limited post-approval monitoring

High trust in extensions with strong install counts

Advantages gained through long-term legitimacy

Although many of these extensions were removed within weeks, ShadyPanda kept on developing its attack strategies.

Koi researchers attribute ShadyPanda's longevity to a consistent gap in extension review processes.

"ShadyPanda proved that marketplaces still review extensions the same way they did seven years ago - static analysis at submission, trust after approval, no ongoing monitoring. Clean Master operated legitimately for five years. Static analysis wouldn't catch this."

To defend against similar threats, individuals are advised to routinely audit installed browser extensions, remove tools they no longer use and favor developers with transparent update histories.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Browser Extensions Infect 4.3M Users with Spyware A seven-year campaign involving malicious browser extensions has infected 4.3 million Google Chrome and Microsoft Edge users with malware, including backdoors and spyware that transmit data to servers in China. The attackers, identified as ShadyPanda, published seemingly legitimate extensions, amassing millions of downloads before deploying the malware. Notably, five of these extensions remain active in the Edge marketplace. 12 sources 44

Extracted Entities

ShadyPanda's Seven

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Platforms (1)

Tools (2)