Firefox joins Chrome and Edge as sleeper extensions spy on users

A Malwarebytes article traces the sleeper extensions phenomenon to a cybercrime group called DarkSpectre, which is linked to three campaigns: ShadyPanda, GhostPoster, and Zoom Stealer. GhostPoster, which initially targeted Microsoft Edge users, later expanded to Chrome and Firefox as the attackers built out their infrastructure, with 17 compromised Firefox extensions identified.

Some of these extensions have more than 50,000 downloads, and the 17 extensions were downloaded more than 840,000 times in total, remaining active in the wild for up to five years. The attackers hid JavaScript code inside images using steganography, enabling monitoring of browser activity and potential backdoors, with the extensions able to see visited sites, search queries, and shopping behaviour to build detailed user profiles.

Mozilla and Microsoft have removed the identified add-ons from their stores, and Google has confirmed their removal from the Chrome Web Store, though already installed extensions remain active until uninstalled. If users fear they have installed one, Malwarebytes recommends a Deep Scan with browsers closed and removal of any found items from the browser. according to Mozilla and Microsoft.