MITRE ATT&CK Technique
T1176Software Extensions
- First Reported
- Jul 22, 2026
- Latest Reported
- Sep 11, 2026
Official Description
Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms.(Citation: Chrome Extension C2 Malware)(Citation: Abramovsky VSCode Security) Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application.
Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls.
The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.
Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls.
The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.
- Tactics
- Persistence
- Platforms
- Linux, macOS, Windows
- MITRE Version
- 2.0
- Last Modified
- Oct 24, 2025
Sub-techniques (2)
Reported Context (2)
- The browser extension used its access to Twitch pages and requests to capture and forward account-scoped OAuth tokens. Twitch Extension Sent About 31,000 Users’ OAuth Tokens to JeetBot Proxies; Fixes Now Available
- Edgecution is sideloaded into Microsoft Edge as a malicious extension masquerading as "Edge Monitoring Agent". UNC6692 Uses Email Bombing, IT Impersonation and Quick Assist to Deploy Edgecution
Malware (1)
People (1)
Threat Actors (2)
MITRE ATT&CK (22)
Vendors (7)
Products (18)
Tools (2)
Industries (2)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.