Microsoft has removed 119 extensions from the Edge add-on store which were all tied to one adware campaign.

In a paper titled “Inside StegoAd: How We Disrupted a Massive Malicious Extension Campaign,” Microsoft researchers detail how they uncovered and dismantled a sophisticated malware campaign that abused browser extensions to infect users. According to Microsoft, the campaign involved 119 malicious browser extensions which were downloaded by 2.6 million users.

The extensions all promised, and delivered, some kind of basic functionality: ad blockers, VPNs, translators, video downloaders, calculators, coupon extensions and so on. But after a while they turned out to be “sleepers” and secretly started downloading additional malware.

Among the payload was malware involved in ad fraud, but also extensions that ran arbitrary JavaScript pushed from the server, which stole Google credentials and second-factor codes at sign-in, harvested WordPress admin logins, and exfiltrated cookies in bulk for session hijacking.

The name of the campaign “StegoAd” is derived from the words advertising and steganography, which means techniques of hiding secrets in something that doesn’t immediately cause suspicion. In this case, hiding code in images.

And not only did the cybercriminals try to stay under the radar by waiting for some time, and hiding malicious code inside images, they also left some victims alone. Some of the extensions only went rogue in about 10% of installs, which would actually execute the next stage of the malware, while the other ~90% would be left alone (at least for that execution attempt). And, in some cases, they re-used names of well-known legitimate extensions to install an additional level of trust.

Browser extensions are a source of wealth for cybercriminals because it compares to installing a small program that lives inside your browser, which can see and report about everything you do on the internet.

Now I hear some of you thinking: I don’t use Edge. Or I’ve used it just once, to download and install my favorite browser. But although Microsoft discovered and analyzed the campaign, the techniques used in this campaign are applicable to Chromium-based browsers in general.

This campaign was less about exploiting a browser vulnerability and more about tricking users into installing a trusted-looking extension, then using sophisticated concealment techniques to avoid detection long enough to compromise systems.

How to stay safe

Always be careful when downloading extensions, even from the reputable app stores. As we’ve seen many times before, criminals manage to get their apps or extensions listed when they are only one update away from turning into malware. So, make sure that you trust the developer and don’t rely on reviews alone.

Use an up-to-date real-time security solution to detect and remove malicious extensions from your device and block connections to malicious domains and IP addresses. Remove the known malicious extensions from your browser. Below is an alphabetical list of the malicious extensions the researchers found by name.

Please note that there might be more than one extension that has the same name. In case you doubt whether the extension you have installed is among them, check whether the ID matches the one shown in the list. If you prefer looking them up by ID, you can find them organized differently in the Microsoft report (pages 40-43).

Extension Name	Extension ID
#Best# PDF Saver	jebcdimkcimkafekgbgbhookdajcoeib
“Download” Button for YouTube	jbmkcmhocoddcokjkahpcchanlmiffhg
“Save” Button for Pinterest	fhkijdlfjnpimenfpnegkecbbijmoipm
…Page Screenshot Clipper	maiackahflfnegibhinjhpbgeoldeklb
7TV	nmhdjlflloeeahacgomilnhmpfnhlpkn
Adblock	aooacabidfijofopjaeligonlfobjcjb
Adblock	dckihkcdmjmlkndgmmgplpcnkmdpangb
Adblock (µBlock clone)	kmiahfbflcnmlobepelpgkmolhodmiek
Adblock For Edge	kikacehfccglblphddbifmiaeiglfdfi
Adblock Master	dgmpkflgbcbpjgniahjegbpelmofbgnn
Adblock Master	hninibdhkeepfndhcdknlijeapngbgdp
Adblock Master for Youtube	jnakfjmfmjmfpmdnghedafdphdanbjkh
Adblock for Youtube	afakckepbbffmnoghgpfnnebijeahjcb
Adblock for Youtube	gclhifbbggfamoojmienffegbmmfnfll
Adblock for Youtube	nipggfgilmoiofmnkbeabghbcaohmjih
Adblocker FX	fkkoeecbjckjpnmenebojblcljjgbpoj
Adblocker Plus for YouTube	imiheoejheaebigkjaeilfmekiikjdbd
AdFly Skipper for Edge	nhfohdhgahjpmniccbgflilignkcnmai
AdSkip-爱奇艺	mimmainmmkddahakleojidjaimaofndp
Ads Block Ultimate	fbobegkkdmmcnmoplkgdmfhdlkjfelnb
AI Search GPT for Edge	beemogkfhphmjghmkghdaggidgohohee
AI Search with ChatGPT	jgngkchljnldpnjimaboboomjmpfpoie
AI Weather Forecast	iaehhmhmdidpkfmddiodkloefndpggcj
AliExpress Helper	elecjoakfjcmjoppfconlfgfemjcaoea
Auto Skip Ads on YouTube	dcelinkcepeidliddjhapgjokheoldjb
Axure RP Viewer	aekfeebhjlmielppjlhebapokdkelion
Batch Image Downloader	hnleilhpfbdofpdnnpjggafhncienakg
Batch Image Downloader	ibfjnghdeenopfkpbmnkablkfejnlnif
Best Speedtest Tool	eklcgjodcnhhcghpbhehhbnmjncbopcg
Best YouTube Adblocker	cjjcndlebdepeddfopnhpifmbfecocfh
Color Enhancer	bmmchpeggdipgcobjbkcjiifgjdaodng
Color by Number	aljmdjbcbkanlhnmcdjbefaomgbekhno
ColorZilla	mdjeohcdegpfoppocljbccpognjlkjke
Convert Everything	ielbkcjohpgmjhoiadncabphkglejgih
Cool Cursor	ajbkmeegjnmaggkhmibgckapjkohajim
CrxMouse – Super Drag	pohfogacehhgefhgmcmnojflfakllkal
CrxMouse Gestures	imcbcfmohachfahkbgijokokjpfmoogb
Custom New Tab for Edge	dbhgpbaaedlknnnochmkjfacnfnakkfa
Downloader for Instagram	higdalghhdbfffdjdiaenminajlmmldb
Download All Images	hnggnhinapdcjocbciajaffnofecfale
Edge Web Highlighter	ijgobfhjjipoljjcejmafocdnfnloflm
Efficient Adblocker for Youtube	oejbpnadmkdiofacgknaaagbmmonhgpb
Enhance YouTube	jecnjeedhbokmpckobjbgieglfjcomek
Evernote in Pinned Tab	elljfaejhdaplocgcejlhfemgimbmcdp
Focus To-Do: Pomodoro Timer & To Do List	nlapjaaepfeadiecaipnacimidfjginj
Free Online Video Downloader	bpdanoaacmebjgfjdmekfcfgmnaoekim
G.B.B.D Translator	fdjpommjpahieenehallhicdhponhacm
GIPHY for Edge	gggjlnkbmgmjboipaegjmjmehmcekamo
Gmail Checker	nhjdhmbdahdidccpobobccagmmijndmp
Google Hangouts	adnahjjfjjemdiefpobclponnhkijnmo
Google search link fix	mjofmhcbolkekhebpccldlbdamnfjefc
Google Translate in Right Click	fcoongackakfdmiincikmjgkedcgjkdp
Hiddence VPN	akfklmfpgmkkhiiolnfbhalkeccjnmeb
HLS Stream Downloader	fgbfcndckldbjifhjgijpjmnpekkelkb
IG Downloader for Edge	ncbpkjcnklnbnkjpcamhhoedlkljeolo
Image Downloader – Batch Download	ngeoikidkjbegoifbnmfimacmbilfcgi
Image Downloader Pro	gnbnbmnldhfoplgjojhepikgjanaplle
Imageye	ikfdcmchafnmklcndfegdlefcfoaggni
ImTranslator	bbofakpgfmlfjpjcahodgpbddocpibge
iQiyi Adblock	hlkenllnegiplhjhpobgangolfkjcgab
iVideo Downloader	amfboegfahhedgehddflgcfbdaapllfj
iYouTubeToMP4	bemebcpaekkmffjjbdakpipemmmlgchb
Language Reactor	hffpfdhdjpbnaddaidajedimmpckekkl
Live Start Page	egbkgelnkodaldbpkgjmhcekjakkcpnk
Magic Actions for YouTube	pjhoiegecdlpaohfffpajaldpbilngog
Marinara: Pomodoro® Assistant	mebgpfbaibhepnkljpimlijicgkbangk
Mouse Tooltip Translator	ibjjllhemkfgfbkgohldepcdgiigpdkb
Natural Reader Text to Speech	eopjamlpanhfkcbnoeofcnmdfdiogfgl
New Tab – Customized Dashboard	edohfgmjmdnibeihfcajfclmhapjkooa
Night Mode	engcfdjknekakgpjkhdobneidcpfbfgm
Night Mode	pgcamkdibinodcpkhenjmofbfobpebpn
One Key Translate	jihipmfmicjjpbpmoceapfjmigmemfam
Picture-in-Picture Playing	kemjiblbeciejjlgobbkffbpnceieefh
Piggy – Automatic Coupons	gmaoimcaoimgmomockloieoifjocpkmf
Pinterest Save Button	kakgeonhimhojdncehlopejkfaapboeo
Return YouTube Dislike	cgoigjefilgfmcjnnendlpdaonlfoncf
RSS Feed	gmciomcaholgmklbfangdjkneihfkddd
Save as PDF	mlgefgipndlgdfjfgnjfheigkagjieea
Save Pinterest on Right Click	glgbgppjjkldoifgpbhbpbkbcdjpgpfj
Screen Shader | Dark Mode	olcibgopfmndlnghnmogcgdhdffdbicg
Similar Sites – Discover Related Websites	fifeankddgioinbcchlokclbcgjlopjj
Similar Sites for Edge	fhhinoefbjlmhakpjohnpabdobgmphli
Simple mass downloader	dbhdfkiddhdhmcikjdgblfjbenjfjlfh
Social Book Post Manager	inelenlaldjofeekhjinpjkacjokagke
SpeakIt!	badiigfpcpfckbhmpmkhokagppaadkim
Speed Control for Youtube	eindenipbnkpeofhpjjimphfchmjoohe
Spell & Grammar Check Tool	fljmegmgjebjdionedkjfgffikhnmcgg
ssYoutube – Video Downloader	okmfpehbgckbneedidbladdaiekikcdo
Summary with ChatGPT	dokiamnhbobapjfhhhcjlfplabeofamp
Super Dark Mode for Edge	lkmeakjjodlkhbikbpdoeicfodaklkna
TikMate	jhahljcmjemimhchigiaigklabnpodgo
TikTok APP for Edge	celdediiemogjpfcjocdbildilkccepl
TikTok Downloader Without Watermark	flcgalphjnojjefjnnimnejbkkefbjgo
To QRcode	cgjomicbgmoadggnjbdiafpjlodmafkp
Transkriptor	lplondnihmdhjokafldkcfnjclkhigpm
Translate Officer	jjdfciihihcpgfgmoonfpgglbgclpfai
Translate Selected Text with Google	obocpangfamkffjllmcfnieeoacoheda
Translate Selected Text with Right Click	fmchencccolmmgjmaahfhpglemdcjfll
Trusted VPN for Edge – Free VeePN	klmfgbnlbfgpdenpdddpdfigmnkmchil
Turbo Download Manager	bpjnmlookdfciblphehedlcbpmignahe
Twitch Custom Emotes – FrankerFaceZ	johcbgkljdbebbloakcollpmigpigkpd
U-Tube Downloader	nphphgkcccnlmdiihcedabnhfacfmojk
Undo Closed Tabs	amemnenomfejhfmfiheekmbcigfkolel
Unblock Youku	ajnjfpjimckjhfcpkaldennpdjglmeml
UseChatGPT.AI	hcmfdagipflbaagmcnhnhabkmjkopcke
Video & MP3 Downloader	oiolhdeinoaidggfcpebifcbedppbgog
Video Downloader Premium	jgphopeamnghlcekffldkpnbhmiadnbc
VPN	pdnjhppcgkdbjolbeplcabkcfmpnbjmh
Weather Forecast	hecicojipmfmablnbhknedademofbbpk
Webpage Screenshot for Edge	eblienbdkbgiigaebhmljbedkafiobkj
YouTube Transcript to Text	nfincgjfplibcdcncfkeehldffppnlnp
YouTube Adblock Plus	flmkfmdmcaepdaoedepihfkhmgopiago
Youtube Adblock Online	hmjdegfgppjddmmojloflajkelegnjdp
Youtube Download	dhnibdhcanplpdkcljgmfhbipehkgdkk
Youtube To MP4 Downloader	cfilkckedhoniijcpjfgihelgepflpni
ZLibrary Searcher	ffedaeoanbhgmanhhecfjodpopcjnhkc
一键翻译	nepdfkaidpemglngbgpnmmhnleiekpin
鼠标手势 (Mouse Gestures)	cbopgngpbfeoecnbebghbbhmdadmllce

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Microsoft shut down the StegoAd campaign, which used 119 malicious Edge extensions, hit 2.6M installs, and ran undetected for two years.

Microsoft just shut down one of the more technically clever malicious extension campaigns it’s ever documented. The operation, named StegoAd, ran 119 extensions on the Edge Add-ons store, racked up roughly 2.6 million installs, and stayed alive for at least two years. The threat actor behind it has been active since 2021.

“Over the past several years, the Microsoft Edge Extensions Security team has tracked a persistent threat actor operating one of the most technically sophisticated malicious browser extension campaigns we have encountered.” reads the report published by Microsoft. “We call it StegoAd, a name combining steganography and ad injection, the two pillars of the campaign’s methodology.”

The extensions looked completely normal. Ad blockers, VPNs, translators, video downloaders, they all worked. They earned positive reviews. The malicious payload didn’t activate until days after installation, which is exactly how the campaign survived multiple detection sweeps.

The name comes from steganography, the practice of hiding data inside ordinary files. This actor hid executable JavaScript inside PNG icon files, then WebP images, then WOFF2 font files. Static scanners saw valid images. What actually ran was a multi-stage attack suite.

“This encoding technique stores JavaScript payload characters as high Unicode codepoints, values in the CJK Unified Ideograph and Private Use Area ranges that overlap with character ranges defined in WOFF2 font files.” continues the report. “To a scanner, it looks like Asian text or font metadata. To the decoder, it’s an executable JavaScript”

The earliest technique appended JavaScript code after the IEND marker at the end of a PNG file. The image rendered perfectly in any viewer. The extension’s own background script read the icon as raw text, found a custom marker string, pulled out everything after it, and executed it. No suspicious domain calls. No obvious obfuscation in the JavaScript source. Standard scanners found nothing.

When PNG detection improved, the actor moved to WebP containers. Same idea, different format, less scrutiny from security tools at the time. After that came WOFF2 font files, where payload characters were stored as high Unicode codepoints in glyph ranges that look like Asian text or font metadata to any scanner that doesn’t decode them.

The most recent variant, spotted in March 2026, disguised a PNG file as a configuration file called setting.conf. The extension fetched it, searched for the marker_vpn_settings, and decoded a Base64 payload split into segments by a ///// delimiter. Calling it a settings file was a nice touch.

The extension stayed dormant for three to five and a half days after installation. Some variants only activated in 10% of sessions on top of that. If you opened DevTools to inspect the extension, a flag called dipFlgDev was set and the dormancy period extended indefinitely. The payload would never fire while an analyst was watching.

The command-and-control server added another layer. It only served real payloads to requests that passed a fingerprint check built from the extension’s own runtime ID, plus the correct User-Agent. Researchers probing the C2 directly got an empty decoy response. The full payloads Microsoft analyzed were intercepted from controlled infected instances, not retrieved by querying the server.

The polymorphic framework, called orderArray, ran across 66 extensions with over 15 naming variants. Every instance had the same four-component structure: an encoded payload object, a seed generator using the extension’s runtime ID, a regex decoder, and a double-Base64 extractor. Variable and function names changed completely across each variant, which defeated fixed-pattern detection rules.

Ad fraud was the visible layer. The extensions injected ads, replaced existing Google AdSense and Amazon ad slots with the actor’s own (capped at six replacements per page to avoid suspicion), and hijacked affiliate commissions on Amazon across more than 20 country-specific stores, plus eBay, AliExpress, Taobao, and JD.com.

Underneath that was a full remote code execution backdoor. The C2 server could push arbitrary JavaScript to any victim’s browser and have it execute within 10 milliseconds. Every extension in the campaign received the same payload modules, meaning all 2.6 million users were exposed to the complete attack surface, not just the ad fraud piece.

The credential theft module targeted Google sign-in pages. It captured the password, waited for the 2FA prompt, captured that code too, and sent both to mitarchive.info via double-Base64 encoding. A separate module hit WordPress admin login pages and attached a SimilarWeb link to each stolen credential so the operator could sort stolen sites by traffic value before deciding what to do with them.

Seven Google Analytics tracking IDs served as the campaign’s telemetry infrastructure. The operator tracked active installs, geographic distribution, merchant click counts, per-ad-replacement performance, and extension version numbers, all through Google’s own dashboard. Hosting telemetry on Google infrastructure meant those beacons blended in completely with normal web traffic.

Two GA4 beacons were served through GitHub Pages. The operator was running what amounts to a professional analytics setup for a criminal campaign, on free hosting, using Google’s tools.

The campaign migrated from Manifest V2 to Manifest V3 as browser platforms tightened restrictions. Where MV2 allowed real-time JavaScript interception of HTTP responses, MV3 requires static declarative rules. The actor solved this by fetching those rules dynamically from the C2 server and installing them into the browser’s declarativeNetRequest API every 15 days. The result was the same header-stripping capability through a more constrained interface.

Each time a wave of extensions was removed, the actor responded within weeks. The C2 domains shifted, encryption schemes changed, and new steganographic formats appeared. Microsoft’s analysis describes a clear detect-and-adapt pattern across eight major milestones from March 2024 through April 2026.

Microsoft has not named the threat actor. Koi Security has linked the credential exfiltration domain mitarchive.info to DarkSpectre, a Chinese operation previously connected to the ShadyPanda and GhostPoster campaigns. StegoAd shares the icon steganography method with GhostPoster and even reuses some extension names, including “Ads Block Ultimate.”

The full list of 119 extension IDs is in Microsoft’s technical report. Open edge://extensions and check your installed add-ons against it. If anything matches, treat the browser as compromised: change your Google password, review recent sign-in activity at myaccount.google.com/security, and check WordPress and Amazon accounts for anything you didn’t do.

“Hardware security keys hold up against this kind of 2FA interception in a way that SMS codes and authenticator apps do not. If you’re still using SMS for 2FA on accounts that matter, this campaign is a reasonable argument for upgrading.” concludes the report. “The StegoAd campaign demonstrates clear technical evolution over 2+ years, with the actor consistently adapting to detection pressure” concludes the report. “The progression also reveals strategic priorities: the actor invests heavily in payload concealment (steganography variants evolved four times) while keeping the monetization logic largely stable. This asymmetry suggests the actor views detection of evasion, not feature development as the primary operational constraint.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, StegoAd)