Chrome, Edge Extensions Caught Tracking Users, Creating Backdoors

On 2 December 2025, SecurityWeek reports that a threat actor named ShadyPanda, according to Koi Security, published more than a hundred malicious extensions for Chrome and Microsoft Edge that can track and profile users and execute payloads with browser API access.

The campaigns have amassed over 4 million downloads, with 20 Chrome extensions released under the name nuggetsno15 in 2023 and 125 Edge extensions under Zhang, all designed to silently inject affiliate tracking codes for sites like eBay, Amazon, and Booking[.]com. The extensions also deployed Google Analytics tracking to monetise browsing data, logging every website visit, search query, and click pattern.

In mid-2024, the actor weaponised five legitimate extensions, transforming them into a remote code execution framework that checks an external server hourly for instructions and runs arbitrary JavaScript with full browser access. The backdoor exfiltrates browser data, including visited URLs, HTTP referrers, timestamps, persistent UUIDs, and complete fingerprints, before encrypting and sending it to remote servers. One notable Edge extension, Clean Master, had over 300,000 installs before its updates intensified the surveillance capabilities.