'ShadyPanda' Hackers Weaponize Millions of Browsers

ShadyPanda, a China-based threat group, has infected 4.3 million Chrome and Edge users through malicious browser extensions that masqueraded as legitimate tools for years before being weaponised. The operators have harvested detailed browsing histories, search queries and credentials, and established remote code execution capabilities to control hundreds of thousands of browsers, with extensions still active in Edge’s marketplace.

Security researchers at Koi identified the actor and noted a seven-year pattern of exploiting marketplace security, with the first campaign in 2023 using up to 145 extensions across Chrome and Edge. These extensions, some of which were gaining Google’s Featured and Verified status, were weaponised with poisoned updates in mid-2024, enabling auto-updates that delivered the RCE backdoor and real-time data exfiltration.

The operation also includes five additional Edge extensions with around 4 million installs, including WeTab, which has at least 3 million users and is used to monitor URLs, searches and mouse clicks, exfiltrating data to attacker‑controlled systems in China. According to Koi Security, Google and Microsoft have since removed the malicious extensions, with Google noting its automated and human reviews and Microsoft urging users to update Edge and audit extensions.