DarkSpectre Hackers Infected 8.8 Million Chrome, Edge, and Firefox Users with Malware
Researchers have identified DarkSpectre, a sophisticated Chinese threat actor responsible for infecting over 8.8 million users across Chrome, Edge, and Firefox browsers. This was achieved through coordinated malware campaigns over seven years.
Researchers have identified DarkSpectre, a sophisticated Chinese threat actor responsible for infecting over 8.8 million users across Chrome, Edge, and Firefox browsers. This was achieved through coordinated malware campaigns over seven years.
The operation involves three major campaigns: ShadyPanda affecting 5.6 million users, the newly discovered Zoom Stealer campaign targeting 2.2 million users, and GhostPoster impacting 1.05 million users. These campaigns are linked to a single organized entity with substantial resources.
The group has maintained legitimate-appearing browser extensions for extended periods before deploying malicious payloads. Koi analysts identified connections between the campaigns by analyzing infrastructure linked to ShadyPanda. The group used legitimate domains to power extension features while connecting to malicious command-and-control infrastructure.
Researchers discovered over 100 connected extensions across multiple browser marketplaces. Extensions communicated with domains flagged in previous investigations, confirming the campaigns were operated by a single actor at a nation-state scale.
This was achieved through coordinated malware campaigns over seven years.
Time-Bomb Activation and Evasion Tactics
DarkSpectre employs advanced persistence and detection-evasion techniques, including "time-bomb" extensions that remain dormant before activating. For example, the "New Tab – Customized Dashboard" extension waits three days after installation to connect to command-and-control servers.
The group uses techniques such as activating malware on only ten percent of page loads and disguising malicious code as PNG image files through steganography. The JavaScript code is protected by custom encoding and encryption to evade detection tools.
Once activated, the extensions download additional JavaScript, allowing threat actors control without triggering extension updates. The threat actors dynamically change payloads on their backend servers, maintaining operational flexibility.
Based on reporting by Cyber Security News.