The Sleeper in Your Browser: How DarkSpectre Turned 8.8 Million Extensions into State-Aligned Spies

DarkSpectre, a Chinese state-aligned threat group, has infected over 8.8 million users across Chrome, Edge and Firefox, operating a network of nearly 300 malicious extensions that functioned as sleeper cells for years. The operation is described as a well-funded, highly disciplined cyber-espionage network that can maintain legitimate software for years before weaponising it.

Researchers report three major campaigns connected by shared infrastructure: The Zoom Stealer affecting 2.2 million users, ShadyPanda with 5.6 million victims, and GhostPoster targeting 1.05 million, all linked by the same ecosystem. The group reportedly updates extensions within the browser marketplace after a long, trust‑building phase, enabling malicious features once a critical mass is reached, according to Koi Security.

To combat this, they deployed Wings, a risk engine powered by agentic AI to analyse every version update, but the article notes millions remain at risk until systemic changes are made.