Microsoft just pulled 119 Edge browser extensions from its store, all tied to a single threat actor that operated for years hiding malware inside seemingly normal image and font files. They’re calling the operation StegoAd.
The scale is unsettling. Around 2.6 million users had these extensions installed. Names you might recognize: ad blockers, VPNs, translators, video downloaders. They did exactly what they promised, which is how this flew under the radar since at least 2021.
The trick was steganography: burying executable JavaScript inside files that looked completely ordinary. Early versions appended code after the IEND marker of PNG icons. When detection caught up, the actor migrated to WebP, then WOFF2 font files, hiding payloads in glyph ranges that appeared to be Asian text or font metadata.
The malicious code stayed dormant through multiple evasion checks before waking up days after install. Some variants didn’t even store the payload locally: they fetched an image from a command-and-control server, decoded it through layers of case swaps, Base64, and XOR, then verified a signature before executing.
And that C2 server? It served real payloads only after fingerprinting requests and checking User-Agent headers. Researchers probing directly got empty decoys. Extensions also watched for open DevTools and extended dormancy if they detected analysis.
The visible damage was ad fraud: injected ads, hijacked affiliate commissions on Amazon, eBay, AliExpress, search redirects. But underneath, Microsoft found something worse. Payloads included a remote code execution backdoor for running arbitrary JavaScript from the server, credential theft targeting Google sign-ins (including two-factor codes), WordPress admin logins, and bulk cookie exfiltration for session hijacking.
The operation ran across more than ten C2 domains with automatic failover, proxied traffic through Cloudflare Workers, and abused GitHub Pages for beacons. A polymorphic framework spanned about 66 extensions under 15 naming variants, migrating from Manifest V2 to V3 as the platform changed.
Microsoft linked the campaign to known Chinese operations. StegoAd credentials exfiltrate to a domain tied to DarkSpectre, the same group behind the ShadyPanda and GhostPoster extension campaigns from late 2025. Some extension names overlap directly.
Check edge://extensions against the published list. If anything matches, or if Edge removed one on its own, change passwords for Google, WordPress, banking, and any other sensitive account immediately. Turn on strong two-factor authentication, and hardware security keys resist this kind of credential theft far better than SMS codes ever will. The full indicators of compromise are in Microsoft’s technical report.
