Your Browser Extensions Have More Access Than Your Malware
842,000 Reasons to Audit Your Extensions Right Now
This week, security researchers disclosed two separate browser extension campaigns that collectively compromised over 842,000 users. The attacks share a common thread: your browser extensions have more access to your data than most malware could ever dream of.
And you installed them yourself.
GhostPoster: Five Years, 840,000 Installs, Zero Detection
The GhostPoster campaign ran for five years across Chrome, Firefox, and Edge before anyone noticed. The technique was elegant: hide malicious JavaScript inside PNG icon files using steganography.
Here's how it works:
- Extension loads its own icon (normal behavior)
- Instead of rendering, it reads the raw bytes of the PNG
- Scans for a marker sequence (===)
- Everything after the marker is executable JavaScript
- Payload activates 6+ days after install
- Phones home every 48 hours, but only executes 10% of the time
That last part is the killer. By introducing randomness, the malware makes network monitoring unreliable. An infected extension might appear completely clean during a security review.
What GhostPoster Does
Once active, the malware:
- Hijacks purchase commissions (affiliate fraud)
- Tracks user behavior across all sites
- Removes security headers (CSP, X-Frame-Options)
- Injects hidden iframes
- Bypasses CAPTCHA protections
Known Bad Extensions
| Extension | Installs |
| Free VPN Forever | 16,000+ |
| screenshot-saved-easy | Unknown |
| weather-best-forecast | Unknown |
| google-translate-pro-extension | Unknown |
| dark-reader-for-ff | Unknown |
Mozilla and Microsoft have removed these from their stores. But here's the problem: already-installed extensions remain active until manually removed.
The Enterprise Attack: Workday and NetSuite Hijacking
While GhostPoster targeted consumers, a separate campaign went after enterprise users. Five malicious Chrome extensions impersonated HR and ERP platforms like Workday, NetSuite, and SuccessFactors.
These extensions work together to:
- Steal authentication tokens
- Block incident response capabilities
- Enable complete account takeover via session hijacking
The Clever Part
One extension (Tool Access 11) prevents access to 44 administrative pages within Workday by erasing page content and redirecting to malformed URLs. It blocks:
- Authentication management
- Security proxy configuration
- IP range management
- Session control interfaces
Another extension (Data By Cloud 2) expands blocking to 56 pages, including:
- Password changes
- Account deactivation
- 2FA device management
- Security audit log access
You can't fix what you can't access.
Why This Matters
Browser extensions operate with privileged access that most malware would kill for:
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
- Read and modify all data on websites you visit
- Access cookies and authentication tokens
- Inject scripts into any page
- Intercept network requests
- Disable security features
And unlike traditional malware, they don't need to evade antivirus, exploit vulnerabilities, or establish persistence. Users grant all these permissions voluntarily during installation.
The Supply Chain Problem
Both campaigns represent supply chain attacks against the browser ecosystem. The Chrome Web Store and Firefox Add-ons marketplace are trusted distribution channels. When malware gets in, users have no reason to suspect it.
The GhostPoster campaign originated on Microsoft Edge, then expanded to Firefox and Chrome. The threat actor maintained infrastructure across all three platforms for years.
What To Do Right Now
For Individuals
- Open your browser's extension manager
- Remove any extension you don't actively use
- Check for the known bad extensions listed above
- Audit permissions - does a weather app need access to "all sites"?
- Reset passwords from a clean browser if you had these installed
For Organizations
- Implement browser extension allowlists
- Use endpoint detection that monitors extension behavior
- Audit Chrome enterprise policies
- Check for unusual authentication patterns in Workday/NetSuite/SuccessFactors
- Consider browser isolation for sensitive applications
The Bigger Picture
This week's disclosures are not anomalies. They're the visible tip of a much larger problem. The browser has become the primary interface for work, and browser extensions are the new attack surface.
Traditional security focused on the endpoint - the operating system, the file system, the network. But modern attacks increasingly target the browser layer, where users have been conditioned to click "Add to Chrome" without thinking.
Your browser extensions have more access than your malware. Act accordingly.
Sources
- HackRead - GhostPoster 840K Installs
- BleepingComputer - GhostPoster PNG Steganography
- LayerX - Full GhostPoster Campaign Scope
- TheHackerNews - Chrome Extensions Session Hijacking
- Socket.dev - Enterprise Extension Analysis
Her name is Renee Nicole Good.
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Look up an IOC → · Audit your brand on AIPM → · See pricing →
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=your-browser-extensions-have-more-access-than-your-malware