ShadyPanda abused browser extensions for seven years, turning 4.3M installs into a multi-phase surveillance and hijacking campaign.

A long-running malware operation known as "ShadyPanda" has amassed over 4.3 million installations of seemingly legitimate Chrome and Edge browser extensions that evolved into malware.

YouTube video by 情報の灯台【パソコン】ソース有り

ShadyPanda abused browser extensions for seven years, turning 4.3M installs into a multi-phase surveillance and hijacking campaign.

We reveals the seven-year waiting game played by ShadyPanda, responsible for infecting 4.3 million Chrome and Edge users

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

A long-running malware operation known as "ShadyPanda" has amassed over 4.3 million installations of seemingly legitimate Chrome and Edge browser extensions that evolved into malware.

普通の拡張機能を装ってユーザーの人気を集め、突然悪意のあるコードをプッシュするという手法で、合計約430万人がマルウェアに感染したことが分かりました。ユーザーは検索クエリや閲覧履歴、ページ滞在履歴等、複数の機密データを窃取され、中国のサーバーに送信されています。

Researchers found more sleeper browser extensions that spy on users and install backdoors, this time targeting Firefox users as well.

A practical breakdown of the ShadyPanda browser extension campaign that quietly hijacked 4.3M Chrome and Edge users, and how to audit and lock down your own extensions.

In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale. A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them run clean for years to build trust and gain millions of installs, then suddenly flipping them into

YouTube video by 情報の灯台【パソコン】ソース有り

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

A long-running malware operation known as "ShadyPanda" has amassed over 4.3 million installations of seemingly legitimate Chrome and Edge browser extensions that evolved into malware.

Sha-Hulud 2.0 NPM/Github/PostHog hack, Glassworm gömmer sitt malware med Unicode Variation Selectors, ShadyPanda Browser Malware, CloudFlare/Rust krash, Ryska hackers trashar OT/ICS honypot, React2Shell, Pixelnapping spionerar på din OTP, Flock kameror usel säkerhet… 01:08:49 Sha-hulud 2.0: NPM och Github brinner igen Dune-masken reser sig ur sanden igen, och hackar NPM, github. Masken blir mer resilient och hittar mer stabil sätt att exfiltera secrets, genom att kollaborativt dela github tokens på github.

YouTube video by Into the Shadows