119 Edge Extensions Pulled After Stealing Logins and 2FA

Microsoft has pulled 119 extensions from the Edge add-on store after tracing them all back to a single adware operation its researchers are calling StegoAd. Between them, the extensions had been installed around 2.6 million times before anyone joined the dots.

The clever part was the patience. Each extension did exactly what its listing promised, whether that was blocking ads, translating pages, downloading videos or running a calculator. They behaved for long enough to build a stack of positive reviews and to slip past whatever automated checks the store throws at new submissions. Then, after a quiet stretch, the extension would reach out for a second-stage payload with the malicious code tucked inside ordinary-looking images. Steganography plus advertising, hence the name.

What the payloads actually did

Once active, the extensions stopped being shy. Some sat in the background committing ad fraud. Others ran JavaScript pushed from a remote server that did considerably more damage:

• Scraped Google sign-ins, including usernames, passwords and second-factor codes as they were typed.
• Lifted WordPress admin logins, useful for turning legitimate sites into delivery platforms for the next campaign.
• Pulled session cookies in bulk, which let attackers walk straight into live accounts without needing the password at all.

To stay quiet, the malicious code only activated on roughly one install in ten. Several of the extensions also borrowed the names of well-known legitimate tools, which made them look more credible in search results inside the store.

This isn't really an Edge story

The interesting bit is what the campaign did not need. There was no browser flaw, no clever exploit, no zero-day. The same techniques port straight across to any Chromium-based browser, which is most of them: Chrome, Brave, and the long tail of niche forks. The whole thing leaned on two assumptions: that the storefront has vetted what it sells, and that an extension which behaved last month is the same extension this month.

Neither is reliably true. Stores do catch malicious uploads, but usually after the install numbers are already in the millions. And an extension can update itself silently in the background, which is exactly the seam StegoAd slipped through.

A more honest way to think about extensions

It helps to treat browser extensions as what they actually are: small programs running with significant access to everything you do in the browser, including your logged-in sessions. That framing changes the questions you ask before installing one.

• Who actually publishes it? A real developer with a track record, or a name you can't find anywhere outside the store listing?
• Do you still use it? Anything you installed a year ago and forgot about is precisely what this campaign was built to be.
• How short can the list get? Fewer extensions means fewer quiet update channels into the browser.

The 2.6 million number is the part that will get the headlines, but it isn't the most uncomfortable bit. The most uncomfortable bit is that the trick worked because the extensions kept their promises. They did the job on the label. They just did some other jobs as well.