DarkSpectre Malware Campaign Hits Chrome, Edge, and Firefox Users
Researchers have identified that a sophisticated Chinese threat actor, known as DarkSpectre, has compromised 8.8 million users across Chrome, Edge, and Firefox through three distinct malware campaigns. These operations have remained undetected for over…
Researchers have identified that a sophisticated Chinese threat actor, known as DarkSpectre, has compromised 8.8 million users across Chrome, Edge, and Firefox through three distinct malware campaigns. These operations have remained undetected for over seven years.
The threat represents one of the most extensive browser extension threats documented. It combines long-term infrastructure investment with nation-state-level operational discipline. The discovery originated from an investigation into the ShadyPanda campaign, initially believed to affect 4.3 million users.
Further analysis revealed additional campaigns associated with the same actor, including GhostPoster, which used steganographic techniques to infect 1.05 million Firefox users, and The Zoom Stealer, which targeted 2.2 million victims for corporate meeting intelligence.
The Zoom Stealer: Targeted 2.2 million users on Chrome, Edge, and Firefox for corporate meeting intelligence. ShadyPanda: Affected 5.6 million users, focusing on surveillance and affiliate fraud across Chrome, Edge, and Firefox. GhostPoster: Infected 1.05 million Firefox users, delivering stealthy payloads.
DarkSpectre employs strategic planning with tailored playbooks for different objectives. The ShadyPanda operation used over 100 extensions disguised as productivity tools. These extensions operated legitimately for 3-5 years before being weaponized through command-and-control updates without requiring store review.
The threat represents one of the most extensive browser extension threats documented.
The Zoom Stealer campaign marks a shift towards corporate espionage. Extensions posed as meeting productivity tools, requesting permissions for platforms such as Zoom, Microsoft Teams, Google Meet, and Cisco WebEx. They scraped sensitive information, including meeting URLs, participant lists, and corporate branding materials, streaming data in real-time to Firebase and Google Cloud infrastructure.
GhostPoster utilized steganography to hide malicious JavaScript in PNG files, executing multi-stage payloads with delayed activation to avoid detection.
Attribution points to a Chinese operation. Command-and-control servers are located on Alibaba Cloud infrastructure in China, with registrations linked to Hubei province. Code artifacts contain Chinese language elements, and affiliate fraud targets Chinese e-commerce platforms like JD.com and Taobao.
Security experts emphasize the need for immediate action. Researchers have identified over 85 sleeper extensions that could pose future threats. The current review-once, update-anytime model in extension marketplaces allows threat actors to bypass security checks.
The operation highlights a fundamental vulnerability in browser extension marketplaces. The persistence and scale of this threat demonstrate the need for enhanced detection mechanisms against well-funded adversaries.
Based on reporting by GBHackers.