ShadyPanda's Years-Long Browser Hack Infected 4.3 Million Users

Back Securityboulevard

ShadyPanda's Years-Long Browser Hack Infected 4.3 Million Users

Securityboulevard • December 4, 2025

Share: View original

“One patient threat actor and one lesson: Trust is the vulnerability,” Admoni wrote. “ShadyPanda proved that marketplaces still review extensions ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ShadyPanda Hack Compromises 4.3 Million Users via Malicious Browser Extensions The China-based cyber-threat group ShadyPanda has infected 4.3 million users through malicious browser extensions on the Google Chrome and Microsoft Edge marketplaces. The group has been operating for years, utilizing these extensions to spy on users, highlighting vulnerabilities in trust and marketplace review processes. 2 sources 36

Extracted Entities

APT Groups (1)

Attack Types (1)