A China-linked threat actor used malicious browser extensions over seven years to steal data and corporate intelligence from Chrome, Edge, and Firefox

DarkSpectre refers to three malware campaigns tied to malicious browser extensions, including 'sleeper' extensions that seem legit, but are not.

Researchers found more sleeper browser extensions that spy on users and install backdoors, this time targeting Firefox users as well.

DarkSpectre browser extension campaigns are exposed after impacting 8.8 million users worldwide, highlighting major browser security risks

A Chinese threat actor, tracked as DarkSpectre by Koi Security, has been identified as the perpetrator behind three malicious browser extension campaigns: ShadyPanda, GhostPoster, and DarkSpectre. These campaigns have impacted an estimated 8.8 million users globally, with 2.2 million users affected by the DarkSpectre campaign alone. The targeted browsers include Google Chrome, Microsoft Edge, and Mozilla Firefox. The malicious extensions are believed to have capabilities for data exfiltration and remote control. However, the available information lacks specific technical details such as dates, indicators of compromise, or infection vectors. This lack of detailed information makes it challenging to provide a comprehensive analysis of the technical implications and impact on the cybersecurity landscape. Nonetheless, the scale of the campaigns underscores the significance of browser extension security and the need for vigilance among users and organizations. Browser extensions have become a popular target for threat actors due to their ability to bypass traditional security measures and gain access to sensitive information. The extensions can be used to steal data, such as login credentials, browsing history, and personal information, or to gain remote control over the affected systems. The use of popular browsers like Chrome, Edge, and Firefox as attack vectors highlights the importance of robust extension vetting processes and user education on the risks of installing untrusted extensions. In terms of actionable intelligence, organizations should consider implementing policies to restrict the installation of browser extensions to those from trusted sources and regularly audit installed extensions for any signs of malicious activity. Users should be educated on the risks of installing extensions from untrusted sources and encouraged to report any suspicious activity. However, without more detailed technical information, it is difficult to provide specific indicators of compromise or mitigation strategies. It is crucial for cybersecurity professionals to stay informed about emerging threats and to share information to better defend against such attacks.

Koi Security unmasks DarkSpectre, a Chinese threat group that used 300+ browser extensions to spy on 8.8M users and steal corporate meeting data.

An anonymous reader quotes a report from Cyber Press: A newly uncovered Chinese threat group, DarkSpectre, has been linked to one of the most widespread browser-extension malware operations to date, compromising...

An anonymous reader quotes a report from Cyber Press: A newly uncovered Chinese threat group, DarkSpectre, has been linked to one of the most widespread browser-extension malware operations to date, compromising more than 8.8 million users of Chrome, Edge, Firefox, and Opera over the past seven year...

Le 30 décembre 2025, les chercheurs de Koi Security ont publié les conclusions de leur dernière enquête sur l’acteur cybercriminel DarkSpectre. Identifié depuis plusieurs années, cet acteur chinois aurait récemment disséminé des extensions de navigateur visant à collecter des renseignements d’entreprise, en extrayant

GhostPoster uses steganography to hide malware inside browser extension logos. Over 1 million victims. Part of DarkSpectre operation hitting 8.8 million users. Seven years undetected.

Le 30 décembre 2025, les chercheurs de Koi Security ont publié les conclusions de leur dernière enquête sur l’acteur cybercriminel DarkSpectre. Identifié depuis plusieurs années, cet acteur chinois au...

A China-linked threat actor used malicious browser extensions over seven years to steal data and corporate intelligence from Chrome, Edge, and Firefox

Un groupe de pirates informatiques li� � la Chine, DarkSpectre, a men� pendant sept ans une campagne de logiciels malveillants qui a infect� 8,8 millions de navigateurs tels que Chrome, Edge, Firefox ...

In an increasingly interconnected digital world, browser extensions, while offering convenience and enhanced functionality, have become a prime target for malicious actors seeking illicit access to user data. AllSafeUs Research Labs, in collaboration with industry partners like Koi Security, is raising the alarm on a sophisticated and widespread campaign dubbed DarkSpectre. This new wave of attacks, attributed to a persistent Chinese threat actor, has already impacted an alarming 2.2 million users across Google Chrome, Microsoft Edge, and Mozilla Firefox.