ShadyPanda — Threat Actor Profile, Campaigns & Targets

Threat entity extracted from intelligence sources

Frequency
14
occurrences
First Seen
December 1, 2025
Last Seen
June 30, 2026

Related Threat Clusters

  • Microsoft Disrupts StegoAd Campaign with Malicious Edge Extensions

    Microsoft has dismantled the StegoAd operation, removing 119 malicious Edge extensions that used steganography to hide malware within image and font files. The campaign, active since 2021, targeted over 2.6 million…

    13 articles · Updated June 29, 2026
  • Malicious Browser Extensions Pose Growing Threat to Cybersecurity

    LayerX Security researchers have revealed that any browser extension can secretly install malware, highlighting a significant security vulnerability. In response, Push Security has launched new detection capabilities to…

    3 articles · Updated March 5, 2026
  • Malicious Browser Extensions Infect 4.3M Users with Spyware

    A seven-year campaign involving malicious browser extensions has infected 4.3 million Google Chrome and Microsoft Edge users with malware, including backdoors and spyware that transmit data to servers in China. The…

    12 articles · Updated December 1, 2025
  • ShadyPanda Malware Campaign Targets Browser Extensions

    The ShadyPanda malware campaign has been identified as a significant threat, converting legitimate browser extensions into spyware. This campaign has been active for several years, affecting users of various browsers,…

    2 articles · Updated December 3, 2025
  • ShadyPanda Hack Compromises 4.3 Million Users via Malicious Browser Extensions

    The China-based cyber-threat group ShadyPanda has infected 4.3 million users through malicious browser extensions on the Google Chrome and Microsoft Edge marketplaces. The group has been operating for years, utilizing…

    2 articles · Updated December 4, 2025
  • Zoom Stealer Extensions Compromise 2.2 Million Users' Meeting Data

    A campaign named Zoom Stealer has been identified, affecting 2.2 million users of Chrome, Firefox, and Microsoft Edge through 18 malicious browser extensions. These extensions are designed to collect sensitive online…

    7 articles · Updated December 30, 2025
  • Malicious Browser Extensions Compromise Millions of Users Across Platforms

    A campaign involving malicious browser extensions has compromised over 4 million users across Firefox, Chrome, and Microsoft Edge. Specifically, 17 malicious Firefox extensions infected over 50,000 users by embedding…

    3 articles · Updated December 16, 2025
  • Malicious Chrome Extensions Steal User Data for Years

    Two malicious Chrome extensions, disguised as proxy tools, have been stealing sensitive user data since at least 2017. Named 'Phantom Shuttle', these extensions have been active in the Chrome Web Store and primarily…

    3 articles · Updated January 6, 2026

Recent Intelligence Reports

  • Microsoft Edge Hit by StegoAd Malware via 119 Malicious Extensions Affecting Over 2.6 ... — Rescana · June 30, 2026
  • Push Security adds malicious browser extension detection to block threats in employee browsers — Feeds2.Feedburner · March 5, 2026
  • Browser extension malware infected 8.8M users in DarkSpectre attack — Foxnews · January 6, 2026
  • Zoom Stealer browser extensions harvest corporate meeting intelligence — Bleepingcomputer · December 30, 2025
  • Zoom Stealer browser extensions harvest corporate meeting intelligence — Bleepingcomputer · December 30, 2025
  • ShadyPanda's Years-Long Browser Hack Infected 4.3 Million Users — Securityboulevard · December 4, 2025
  • Browser Extensions Under Fire: 4 Million Users Affected by Malware — Observervoice · December 4, 2025
  • 'ShadyPanda' Hackers Weaponize Millions of Browsers — Darkreading · December 3, 2025

CVSS v3.1 Breakdown