Malicious ‘Sleeper Agent’ Browser Extensions Infected 1.5 Million Users Globally
LayerX has identified a network of malicious browser extensions, called "sleeper agents," installed on approximately 1.5 million devices globally. These extensions, which appear as legitimate sound management tools, share a codebase and infrastructure,…
LayerX has identified a network of malicious browser extensions, called "sleeper agents," installed on approximately 1.5 million devices globally. These extensions, which appear as legitimate sound management tools, share a codebase and infrastructure, suggesting development by a single entity.
Despite their benign appearance, these extensions possess hidden capabilities. They can execute remote commands, open background tabs, communicate with malicious domains, and use encryption and obfuscation techniques to evade detection by traditional security tools. This infrastructure allows attackers to activate malicious behavior, potentially turning users’ browsers into launchpads for cyberattacks.
Shared Malicious Codebase and Remote Command Execution
Analysis reveals similarities with previously removed malicious extensions, such as ReadBee (Extension ID: phjbepamfhjgjdgmbhmfflhnlohldchb). The core infrastructure includes the ExtStatTracker class, which tracks user activity and enables remote command execution. It encodes user data and sends it to external servers, like readrbee.com, and can open URLs in new tabs without user consent.
Below is a simplified overview of the ExtStatTracker class:
class ExtStatTracker { constructor() { this.installUrl = "https://readrbee.com/install/"; this.uninstallUrl = "https://readrbee.com/uninstall/"; this.uid = ""; this.version = chrome.runtime.getManifest().version; this.initStorage(); this.initListeners(); } processQueue() { // Sends encoded user data and executes remote commands // Opens arbitrary URLs via chrome.tabs.create() } setUninstallUrl() { // Sets uninstall URL with encoded user data } initListeners() { // Listens for install/update events and queues actions } initStorage() { // Retrieves and stores persistent user identifiers } } const extStatTracker = new ExtStatTracker;
Obfuscated Ownership and Widespread Impact
LayerX has identified at least four extensions involved in this campaign, focusing on sound management, with a user base exceeding 1.2 million. These extensions remain available on the Chrome Web Store, with publishers using anonymous identities, complicating attribution efforts.
LayerX has identified a network of malicious browser extensions, called "sleeper agents," installed on approximately 1.5 million devices globally.
Extension Name Extension ID Users
Sound Booster pmilcmjbofinpnbnpanpdadijibcgifc 200,000
Volume Max – Ultimate Sound Booster mgbhdehiapbjamfgekfpebmhmnmcmemg 1,000,000
Volume Master: Master Your Sound eoejmjkddfbhhnbmklhccnppogeaeeah 3,000
Volume Booster: Ultimate Sound Enhancer dlcgileladmbfijjmnleehhoebpggpjl 2,000
Some extensions have been flagged as malicious by security vendors but remain accessible. They communicate with domains like francjohn[.]com and jermikro[.]com, which have histories of malware activity.
The discovery of this network signals a shift in cybercriminal tactics. Instead of traditional botnets from compromised IoT devices, attackers use browser extensions for persistent, stealthy access to sensitive data, including cookies and passwords. The infrastructure allows for remote activation of malicious capabilities, highlighting the importance of continuous monitoring and vetting of browser extensions.
Security experts advise users and organizations to remain vigilant, regularly audit installed extensions, and treat even seemingly innocuous tools with caution, as the threat landscape evolves in sophistication and scale.
Based on reporting by GBHackers.