[CS-TR-26-1101A] CRITICALSTART® Cyber Research Unit (CRU) · Threat Research
The CRITICALSTART® Cyber Research Unit (CRU) is tracking a sustained run of malicious extensions that reached users in enterprises through official marketplaces, including the Chrome Web Store, Firefox Add-ons, Microsoft Edge Add-ons, and Open VSX. The campaigns leveraged working features, familiar brand names, and ordinary manifest settings to look legitimate. The observed malicious extensions logged search queries, wallet recovery phrases, artificial intelligence (AI) chat content, and developer environment data.1, 2, 3, 4 Some operations skipped the marketplace entirely, because malware wrote the extension directly into the browser profile.5, 6 A marketplace listing shows who published an extension and how popular it is, but it does not show what the extension will do next. Organizations should therefore treat extensions as software to approve, inventory, and continuously monitor for changes.
Modern extensions are not cosmetic additions to browsers and development environments. Depending on their permissions, they can change browsing behavior, read web content, interact with authenticated applications, reach development resources, and communicate with external infrastructure. Their usefulness comes from this integration, and so does their potential for abuse. A browser extension that promises to convert documents, block advertisements, improve search results, or protect privacy rarely feels like a security decision and offers more convenience. For most users, installing one is routine. The software comes from a familiar marketplace, its permissions appear in a standard dialog, and its advertised function caters to an immediate need. That convenience creates an opportunity for attackers.
Recent investigations across the Chrome Web Store, Firefox Add-ons,20 Microsoft Edge Add-ons, and Open VSX reveal that attackers exploit the credibility of established distribution platforms. Threat actors package malicious software and let the marketplace experience supply the appearance of legitimacy. In October 2026, Socket researchers disclosed 319 Chrome extensions with about 13.4 million reported installs across a decade.1 Advertisements promoted them as manual finders, PDF converters, safe-search tools, and AI search assistants.7 Their observed purpose was different. They replaced the default search engine and routed queries through operator-controlled servers that could read each search and earn referral payments from Yahoo and Bing.1, 7 The scale illustrates a basic weakness in the extension ecosystem: distribution through a recognized marketplace can create confidence without providing continuous assurance that the software behaves safely.
Official marketplaces provide security benefits through centralized distribution, publishing requirements, submission reviews, and software removal. However, approval does not guarantee trustworthy behavior after installation. The Searchjacked campaign illustrates why: malicious extensions used Chrome's chrome_settings_overrides.search_provider capability to redirect searches through operator-controlled servers before forwarding them to legitimate search engines.1, 8 These intermediaries could collect queries, attach referral identifiers, and change destinations without updating the installed extensions. Socket observed six identical searches through one extension reaching four different destinations.9 The finding highlights a critical limitation of marketplace review: it cannot guarantee the security of external infrastructure controlling an extension's behavior.10
Malicious extensions can deliver their advertised functionality while performing unauthorized activities in the background. In August 2026, Socket identified 737 Chrome VPN extensions with more than 75,000 reported installs, distributed across at least 40 developer accounts.11 Of these, 274 impersonated established VPN and privacy brands, while 520 routed browser traffic through attacker-controlled SOCKS5 proxies.11 Similarly, two Chrome ad blockers genuinely blocked advertisements using public filter lists while recording conversations with eight AI platforms for approximately 90,000 users.3 Another network of 152 live-wallpaper extensions claimed not to collect user data despite logging IP addresses, ISP details, and clicks.12, 13 In these cases, legitimate functionality helped conceal behavior users had not authorized.
Longevity compounds this risk. Rather than activating malicious functionality immediately, some extensions delay execution until after installation, potentially evading initial review. Microsoft's investigation of the StegoAd campaign identified 119 malicious Edge extensions with payloads concealed in image and font files. Some remained dormant for days and activated only on a subset of installations.14 Microsoft concluded that static code review alone could not reliably identify extensions capable of downloading malicious code after approval.15 For enterprises, this creates risks beyond individual privacy: browser proxies can affect access to corporate applications, while extensions interacting with authenticated sessions may expose sensitive organizational information. An extension's advertised purpose is therefore a claim to verify, not evidence of its security.
Attackers also exploit familiar names, logos, and interfaces to make malicious extensions appear legitimate. Cryptocurrency wallets are particularly attractive targets because their extensions handle sensitive recovery phrases and private keys. In October 2026, Socket documented 16 malicious Firefox extensions impersonating Rabby and OKX Wallet.16, 21 Although their manifests declared that they collected no data, the extensions intercepted recovery phrases and private keys and transmitted them through URL query parameters to attacker-controlled Cloudflare Workers.2, 16 Mozilla had unpublished all 16 by October 5, although no victim totals or confirmed financial losses were reported.16 These attacks move phishing into the installation process: users may enter sensitive credentials into a deceptive interface without ever visiting a phishing website. Remote code retrieval further allows malicious behavior to change after installation, undermining point-in-time security assessments.
Irreversible impact: For wallet holders, the consequences can be irreversible. Uninstalling an extension cannot recover a compromised recovery phrase or private key.
Code editor extensions can expose organizations to risks that extend well beyond individual developer accounts. They operate in environments containing proprietary source code, repository credentials, API tokens, cloud configurations, and CI/CD resources, making them attractive targets for data collection and software supply chain attacks. In August 2026, Manifold Security identified 77 counterfeit extensions in Open VSX impersonating legitimate VS Code Marketplace products. All 77 contacted the same recently registered domain, and 19 collected machine, repository, and CI information.4, 22 Because the two registries maintain separate publisher identities, familiar names and descriptions do not guarantee that an extension comes from its legitimate developer.4 Even seemingly benign themes can conceal malicious functionality. In October 2026, Socket linked a cluster of VS Code themes across both marketplaces to the GlassWorm campaign. Two were confirmed malicious: one retrieved payload infrastructure through a Solana blockchain transaction memo, while another downloaded and executed attacker-controlled batch files. Microsoft subsequently removed the affected Marketplace listings.23 CRU assesses with moderate confidence that themes executing code at startup warrant the same scrutiny as other extensions, regardless of their cosmetic purpose.
Some attackers bypass marketplaces entirely, installing extensions directly into browser profiles. In September 2026, reporting on the KREMLIN banking malware toolkit described campaigns impersonating Brazilian banks to distribute malware that installed an extension disguised as "AVSync" and manipulated Chromium's integrity checks to conceal the mod.5, 6 Elastic Security Labs identified 1,515 infected systems, more than 98% geolocated to Brazil.5, 6 Other campaigns leverage fake installers and ClickFix prompts to trick victims into executing commands that install extensions disguised as ad blockers.24, 25 These attacks demonstrate that marketplace screening cannot prevent unauthorized installation following endpoint compromise. An extension can become part of a broader intrusion rather than its initial entry point. Chrome developers have also been working on protections against policy-installed extensions that hijack New Tab pages or default search settings on unmanaged devices, although these protections were not in stable Chrome as of the August reporting.26 Organizations must therefore look beyond marketplace listings, monitoring extension inventories, unexpected browser-profile modifications, and suspicious browser behavior.
The table maps observed behavior to the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework.
| ID | Technique | Observed use |
|---|---|---|
| T1176.001 | Software Extensions: Browser Extensions | Hostile Chrome, Edge, and Firefox extensions persist in the browser with user-granted access.1, 2 |
| T1176.002 | Software Extensions: IDE Extensions | Counterfeit and theme extensions run when the editor loads.4, 23 |
| T1036 | Masquerading | Wallet, VPN, and developer-tool lookalikes copy names, icons, and namespaces.4, 11 |
| T1204.004 | User Execution: Malicious Copy and Paste | ClickFix prompts persuade users to run attacker commands.24 |
| T1027.003 | Obfuscated Files or Information: Steganography | StegoAd hides payloads in images and fonts.14 |
| T1102.001 | Web Service: Dead Drop Resolver | GlassWorm loaders resolve infrastructure from Solana transaction memos.23 |
| T1105 | Ingress Tool Transfer | Loaders retrieve second-stage code at runtime.17 |
| T1562 | Impair Defenses | KREMLIN regenerates Chromium integrity values to load extensions.5 |
| T1090 | Proxy | Fake VPN extensions route traffic through SOCKS5 servers.11 |
| T1056 | Input Capture | Wallet clones capture recovery phrases and private keys during import.2 |
| T1041 | Exfiltration Over C2 Channel | Stolen secrets leave in URL parameters sent to attacker-controlled endpoints.16 |
The evidence argues for a more deliberate approach than telling users to install software only from official marketplaces. Exposure follows the data an extension can reach, so employees who manage wallets, work in code editors, use AI assistants, or rely on VPN tools carry the most risk and should be treated as a distinct group. Controls must also extend beyond installation. Network monitoring can reveal unexpected connections to external services, and endpoint telemetry can reveal unauthorized changes to browser profiles or developer environments. For extensions that handle credentials, authenticated sessions, source code, or financial assets, the acceptable level of access should be especially narrow. These measures do not end marketplace abuse. They reduce the chance that a convincing listing becomes an unrestricted path into the organization.
To mitigate risks associated with malicious marketplace extensions, we recommend the following:
.vscode/extensions.json and devcontainer.json, for identifiers associated with the Open VSX campaign. Search network logs for mangorbit[.]com.ExtensionSettings policy where possible. Apply Firefox's ExtensionSettings policy to enforce equivalent restrictions.Malicious marketplace extensions exploit the relationship between convenience and confidence. The threat does not always require sophisticated exploitation, because a deceptive name, an ordinary manifest setting, a working utility, or a convincing listing can be enough to establish access. Users and organizations should not equate marketplace availability with verified behavior. That raises a harder question. What happens when an extension is legitimate at installation, earns years of user confidence, and becomes malicious later? That is the subject of the second article in this series.
This advisory was written using the best intelligence available at the time and is subject to change as additional information becomes available. Visit Critical Start's Resources page for threat research articles and security advisories.
| Campaign | Type | Indicator |
|---|---|---|
| Open VSX counterfeits | Domain | mangorbit[.]com (registered July 15, 2026) |
| Fake VPN network | Behavior | chrome.proxy.settings routing traffic to SOCKS5 proxies on port 1082 |
| Firefox wallet clones, wave 2 | Domain | *.icy-star-f45c.workers[.]dev |
| Firefox wallet clones, wave 3 | Domains | phantom[.]bonto[.]io, jupiter[.]bonto[.]io, bitget[.]bonto[.]io |
| Wallpaper network | Domains | tabplugins[.]com, yowgames[.]com, chromewallpaper[.]com |
| Searchjacked | Domain | search.safesearchgame[.]com |
| GlassWorm-linked themes | Extension IDs | cosmic-themes.theme-cosmic-nebula, cosmic-themes.sql-formatter |
| KREMLIN | Extension name | Extension masquerades as "AVSync" |
| CastleLoader | Domains | grenagana[.]com, thenugcompany[.]org, avivtech[.]org |