Scworld

LayerX Identifies Browser Extension Malware Concealed in PNG Files

First seen 17 Jan 2026, 05:01 UTC • Scworld

+1 •29.1

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

LayerX has uncovered a significant cybersecurity threat linked to the GhostPoster browser extension. Koi Security's analysis revealed that malicious code was hidden within PNG image files, enabling the extension to bypass standard security checks and affect users unaware of its capabilities.

How this analysis works

Attack Flow

10 entities, 8 inferred relationships (STIX 2.1).

Technique (1)

Malware

Campaign (1)

GhostPoster Campaign

Organization (3)

NetSuite
SAP SuccessFactors
Workday

Malware (1)

GhostPoster

Affected Platform (3)

Chrome Web Store
Firefox
Microsoft Edge

Tool (1)

Chrome

Relationships

GhostPoster Campaign uses GhostPoster
GhostPoster targets NetSuite
GhostPoster targets SAP SuccessFactors
GhostPoster targets Workday
Malware targets Chrome Web Store
Malware targets Firefox
Malware targets Microsoft Edge
GhostPoster Campaign related to Chrome

Continue Reading

Microsoft Disrupts StegoAd Campaign with Malicious Edge Extensions Malicious Browser Extensions Pose Growing Threat to Cybersecurity MeetingTV Sues Koi Security Over AI-Generated Espionage Claims Zoom Stealer Extensions Compromise 2.2 Million Users' Meeting Data GhostPoster Malware Infects 17 Firefox Add-ons with Over 50,000 Downloads 17 Malicious Chrome Extensions in GhostPoster Campaign Compromise User Data

LayerX Identifies Browser Extension Malware Concealed in PNG Files

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading