Microsoft has shut down a long-running malicious extension operation on the Edge Add-ons store that hid its payloads inside ordinary image and font files, then woke up days after install to steal credentials and run ad fraud. The company calls it StegoAd, a mash-up of steganography and adware, and ties 119 extensions to a single threat actor it says has been active since at least 2021.

Artificial intelligence is rapidly transforming browser extension development into an automated assembly line, yet manual review processes drastically fail to keep pace. A novel side effect has recently materialized within the Edge Add-ons ecosystem: an unrelenting flood of new and updated extensions has completely overwhelmed the moderation queue. Consequently, Microsoft explicitly linked this massive surge in submissions directly to the widespread adoption of AI-powered coding utilities.

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share similarities in code and tradecraft, with evidence indicating that the campaign may have been active