WeTab is a malware family tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed December 2, 2025; most recent activity December 2, 2025.
WeTab is a malware family linked to the ShadyPanda operation, observed in a campaign that targets and compromises browsers at a large scale. It is notable for its focus on browser compromise and the potential for widespread impact, including ad injection, traffic manipulation, or credential harvesting. The reported reach—millions of infected browsers—highlights its significance for threat intelligence and defense.
A seven-year campaign involving malicious browser extensions has infected 4.3 million Google Chrome and Microsoft Edge users with malware, including backdoors and spyware that transmit data to servers in China. The…