“Sleeper” browser extensions woke up as spyware on 4 million devices

Researchers have uncovered a long-running campaign in which a set of browser extensions installed on roughly 4.3 million Chrome and Edge users’ devices suddenly started behaving as spyware. Five extensions operated cleanly for years before being weaponised in mid-2024, with the developers earning trust and achieving millions of installs, even gaining “Featured” or “Verified” status in the Chrome and Edge stores.

The extensions turned into a remote code execution framework, able to download and run malicious JavaScript inside the browser and to collect information about visited sites and the user’s browser, sending it back to attackers believed to be based in China. One of the most prevalent extensions is WeTab, with around three million Edge installs, acting as spyware by streaming visited URLs and other data in real time; Google has removed the extensions, though Edge store versions remain available.

The campaign has been attributed to the ShadyPanda group, active since at least 2018, with updates to existing extensions proving a key tactic. Each infected browser now runs a remote code execution framework that checks api.extensionplay[.]com for new instructions every hour.