Microsoft Removes 119 Edge Extensions Linked to StegoAd Campaign
Summary
Microsoft removed 119 Edge extensions linked to StegoAd, which hid payloads in PNG, WebP and WOFF2 files and used delayed execution to evade analysis. Microsoft says they stole credentials and cookies; installs reached 2.6 million, but the number compromised is unknown.
Key points
- Microsoft removed 119 extensions and suspended more than 90 developer accounts; the extensions had up to 2.6 million installs, not a confirmed victim count.
- The extensions concealed code in PNG, WebP and WOFF2 files; some variants fetched image-based payloads from command-and-control servers and decoded them before execution.
- Delayed activation, server-side validation, execution gates and checks for analyst activity helped the extensions evade detection.
- Microsoft's analysis found payloads that stole Google credentials and second-factor codes, harvested WordPress logins, and exfiltrated cookies for session hijacking.
- The extensions also injected ads, hijacked affiliate commissions and redirected searches; payloads included a backdoor capable of running JavaScript sent by a server.
- Microsoft did not name the actor. The article reports links to DarkSpectre and overlaps with the GhostPoster and ShadyPanda campaigns; actual compromise numbers are unknown.
- Microsoft advises checking installed extensions against its list, changing passwords for sensitive accounts, reviewing sign-ins and using strong two-factor authentication.
Article Details
- Attack Vectors
- 119 malicious Edge extensions concealed JavaScript payloads in PNG, WebP, and WOFF2 files using steganography.
- Some extensions fetched disguised image payloads from command-and-control servers, decoded them through case and digit swaps, Base64, and XOR, then checked a signature before execution.
- Payload execution was delayed and gated by server-side validation, fingerprint and User-Agent checks, and—in some variants—a 10% execution gate. Extensions also extended dormancy when they detected open DevTools.
- Retrieved payloads ran arbitrary JavaScript from a server, stole Google credentials and second-factor codes at sign-in, harvested WordPress admin logins, and exfiltrated cookies for session hijacking.
- Extensions injected ads, redirected searches, and hijacked affiliate commissions, including on Amazon, eBay, and AliExpress.
- Defensive Notes
- Compare installed Edge extensions with Microsoft's published list of the 119 removed extensions; treat the browser as exposed if an extension matches or was removed automatically.
- Change passwords for Google, WordPress, banking, and other sensitive accounts, and review recent sign-in activity.
- Enable strong two-factor authentication; Microsoft recommends hardware security keys over SMS codes for this threat.
- Microsoft published indicators of compromise for use across Chrome, Firefox, and other Chromium browsers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mitarchive[.]info | Domain to which the StegoAd credential payload exfiltrates; Koi Security ties the domain to DarkSpectre. |
MITRE ATT&CK
T1027.003 · SteganographyThe extensions concealed executable code in PNG, WebP, and WOFF2 files using steganography.T1041 · Exfiltration Over C2 ChannelThe article says the credential payload exfiltrated to mitarchive.info.T1059.007 · JavaScriptThe payload included a backdoor that ran arbitrary JavaScript pushed from a server.T1090.002 · External ProxyMicrosoft reports that the actor proxied traffic through Cloudflare Workers.T1105 · Ingress Tool TransferSome extensions fetched image files from a command-and-control server and decoded them to obtain payloads.T1176 · Software ExtensionsThe operation distributed malicious functionality through 119 Edge extensions.T1185 · Browser Session HijackingStolen cookies were used for session hijacking.T1497.003 · Time Based ChecksPayloads remained dormant for days, and some variants used an execution gate; extensions could extend dormancy when analyst activity was detected.T1539 · Steal Web Session CookieThe payloads exfiltrated cookies in bulk for session hijacking.T1622 · Debugger EvasionExtensions monitored for open DevTools and extended dormancy when they detected an analyst looking.
Threat Actors
DarkSpectreKoi Security ties mitarchive.info, the domain used for StegoAd credential-payload exfiltration, to DarkSpectre. The article presents this as a connection, while Microsoft has not named the StegoAd actor.GhostPosterThe article says StegoAd shares the technique of hiding code in an extension icon with GhostPoster and that the campaigns share extension names. Microsoft has not named the StegoAd actor.ShadyPandaThe article describes ShadyPanda as one of the extension campaigns linked to the Chinese operation associated with DarkSpectre; it does not establish that ShadyPanda conducted StegoAd.
Vendors
Products
EdgeMicrosoft shut down StegoAd, a long-running Edge Add-ons campaign that used steganography in image and font files to hide malicious code inside 119 extensions.Google AnalyticsMicrosoft says seven Google Analytics tracking IDs appear to have served as covert telemetry, giving the operator near real-time dashboards on the campaign through Google’s own infrastructure.WordPressThe campaign stole Google and WordPress credentials and cookies.