Microsoft Removes 119 Edge Extensions Hiding Malware in Images and Fonts

Microsoft has removed 119 malicious extensions from the Edge Add-ons store that used steganography to hide malware in image and font files. The operation, dubbed StegoAd, has been active since at least 2021 and involved extensions like ad blockers, VPNs, and translators that appeared legitimate. The malicious code remained dormant for days, evading detection by checking for developer tools and server-side validation. The extensions had up to 2.6 million installs, though the actual number of compromised users is unknown.

The malware used steganography to embed executable code in PNG icons, WebP images, and WOFF2 font files. Some variants fetched payloads from command-and-control servers, decoding them through multiple layers of obfuscation. The C2 servers only responded to requests with specific fingerprints, returning empty responses to probes. The extensions also monitored for open DevTools to avoid analysis.

The primary impact was ad fraud, including injected ads and hijacked affiliate commissions on Amazon, eBay, and AliExpress. However, deeper analysis revealed credential theft capabilities, including stealing Google credentials, second-factor codes, WordPress admin logins, and cookies for session hijacking. Microsoft identified seven Google Analytics tracking IDs used for covert telemetry. The infrastructure included over ten C2 domains with failover, Cloudflare Workers for proxying, and GitHub Pages for hosting beacons. The operation migrated from Manifest V2 to V3 and involved 66 extensions under 15 naming variants.

Microsoft has removed all extensions and suspended over 90 developer accounts. Users are advised to check their installed extensions against the list of removed IDs, change passwords for sensitive accounts, enable strong two-factor authentication, and review recent sign-in activity. Indicators of compromise have been published for Chrome and other Chromium browsers. The credential payload exfiltrates to mitarchive.info, a domain linked by Koi Security to the DarkSpectre operation, which was previously associated with the ShadyPanda and GhostPoster extension campaigns. The operator remains active.