ShadyPanda Malware Infects 4.3M Chrome, Edge Users via Extensions

Cybersecurity researchers have uncovered a long-running malware campaign attributed to a China-based hacking group known as ShadyPanda, which infected more than 4.3 million users of Google Chrome and Microsoft Edge browsers through seemingly legitimate extensions available on official stores.

The operation spanned approximately seven years, with attackers uploading innocuous extensions as early as 2018 to build trust and amass users before injecting malicious code via automatic updates in mid-2024. According to a report from Koi Security, the firm that identified the threat, ShadyPanda exploited the platforms' auto-update mechanisms, designed to keep extensions current, to silently deliver spyware without user notification. This allowed the malware to collect sensitive browsing data and transmit it in real time to servers in China.

Koi Security detailed two primary campaigns. The first involved five extensions that operated legitimately for several years, including Clean Master, a cache cleaner with over 300,000 installs that had earned Google's Featured and Verified badges. These were transformed into remote code execution backdoors, enabling attackers to remotely control...