Microsoft has removed 119 malicious extensions from the Edge Add-ons store after uncovering a long-running operation it calls StegoAd.
The campaign used browser extensions that looked useful and legitimate: ad blockers, VPNs, translators, video downloaders, and other everyday utilities. Many appeared to work as promised and collected positive reviews, helping them stay trusted for years.
But beneath the surface, the extensions used steganography to hide malicious code inside ordinary-looking image and font files. Once activated, they could steal credentials, hijack sessions, inject ads, redirect searches, and support affiliate fraud.
According to public reporting on Microsoft’s findings, the operation may have reached up to 2.6 million installs, though Microsoft treated that number as a ceiling rather than a confirmed victim count.
What Is StegoAd?
The name StegoAd combines two ideas: steganography and adware.
Steganography is the practice of hiding data inside something that looks harmless. In this case, malicious code was hidden inside files that appeared to be normal browser extension assets, such as icons, images, and fonts.
That made the extensions harder to detect with static scanning.
To users, the extensions looked ordinary. To security tools, the files often looked like normal PNG, WebP, or WOFF2 assets. But hidden inside those files was code that could be decoded and executed later.
This is what made StegoAd different from many simpler malicious extension campaigns.
It did not rely only on obvious malicious JavaScript. It hid payloads inside the kind of files every extension normally contains.
How the Extensions Stayed Hidden
Microsoft says the actor used multiple layers of evasion.
The extensions did not activate immediately after installation. Some waited several days before running malicious behavior.
That delay helped them avoid quick store review, sandbox analysis, and immediate user suspicion.
Some variants also used server-side validation and execution gates. In certain cases, only a percentage of installations received the active payload.
That means many installs may never have triggered the full malicious chain.
The extensions also checked for signs of analysis, including open developer tools. If they suspected they were being inspected, they could extend dormancy or avoid serving the real payload.
This allowed the operation to remain active for a long time while hiding in plain sight.
Code Hidden in Images and Fonts
The campaign’s defining trick was hiding executable code inside ordinary extension assets.
Early variants reportedly appended JavaScript after the IEND marker of PNG image files. The image still rendered normally, but it contained a hidden payload after the legitimate image data.
As detection improved, the actor shifted techniques.
Later variants used WebP images and WOFF2 font files, hiding code in areas that looked like glyph data, Asian text ranges, or font metadata.
Some high-impact variants did not even ship the full payload inside the extension.
Instead, they fetched a normal-looking image from a command-and-control server. The extension then decoded it through several transformation layers, including case swaps, digit swaps, Base64, and XOR, before validating it with a signature and executing it.
The C2 server also performed checks before serving the real payload. Requests that failed fingerprinting or User-Agent validation received empty or decoy responses.
That made direct probing harder for researchers.
Ad Fraud on the Surface
The most visible part of StegoAd was ad fraud.
The extensions could:
- inject unwanted ads
- redirect searches
- hijack affiliate commissions
- manipulate browsing flows on shopping sites
- degrade the browsing experience
Targets included major platforms such as Amazon, eBay, and AliExpress.
This kind of monetization is common in malicious extension campaigns because it can generate revenue quietly over time.
The user may notice extra ads or strange redirects, but may not immediately connect the behavior to a browser extension.
Credential Theft Underneath
Microsoft’s analysis found that the campaign went beyond ad fraud.
The retrieved payloads included capabilities for credential theft and session hijacking.
According to the provided report details, the payloads could:
- steal Google credentials during sign-in
- capture second-factor codes
- harvest WordPress administrator logins
- exfiltrate cookies in bulk
- support session hijacking
- run arbitrary JavaScript from the server
This changes the severity of the campaign.
What appears to be annoying adware can become account compromise, identity theft, or business exposure.
For organizations, a malicious browser extension can become a serious endpoint risk, especially if users access cloud apps, admin panels, email, or internal tools through the same browser.
Abuse of Legitimate Infrastructure
StegoAd also relied on legitimate infrastructure to blend in.
Microsoft reportedly identified more than ten command-and-control domains with automatic failover. The actor also used Cloudflare Workers as proxies and abused GitHub Pages to host beacons.
The operation also used Google Analytics tracking IDs as covert telemetry, giving the operator near real-time campaign visibility through Google’s own infrastructure.
This is an increasingly common pattern.
Attackers use trusted platforms not only to host content, but also to make malicious traffic harder to block without disrupting normal business activity.
Built to Adapt
StegoAd was not a short-lived campaign.
Microsoft tied the operation to a single threat actor active since at least 2021 and found evidence of continued adaptation.
The operation reportedly used a polymorphic framework across around 66 extensions with more than 15 naming variants.
It also migrated from Manifest V2 to Manifest V3 as browser extension platform rules changed.
That matters because it shows the operator was not simply uploading throwaway extensions.
They were maintaining an ecosystem.
They adapted to platform changes, improved evasion, rotated infrastructure, and kept the campaign alive across multiple extension identities.
Possible Link to DarkSpectre
The campaign may overlap with earlier malicious extension activity.
The credential payload reportedly exfiltrated data to mitarchive.info, a domain Koi Security previously associated with DarkSpectre, a Chinese operation linked to the ShadyPanda and GhostPoster extension campaigns.
There are also technical similarities.
StegoAd hid code inside an extension’s icon, a technique reportedly used by GhostPoster months earlier. Some extension names also overlapped, including Ads Block Ultimate.
Microsoft has not publicly named the actor, but the overlap suggests StegoAd may be part of a broader malicious extension ecosystem rather than an isolated incident.
What Users Should Do
Microsoft says all 119 extensions have been removed and the associated developer accounts suspended.
Users should still check their browsers.
Recommended steps:
- open
edge://extensions - compare installed extensions against Microsoft’s published list
- remove any matching or suspicious extensions
- check whether Edge removed anything automatically
- change passwords for sensitive accounts
- review recent sign-in activity
- clear suspicious sessions
- enable strong two-factor authentication
- prefer hardware security keys for important accounts
Users should pay special attention to Google, WordPress, banking, email, and other sensitive accounts.
If a malicious extension had access to cookies or credentials, removing the extension alone may not be enough.
What Organizations Should Do
For security teams, StegoAd is another reminder that browser extensions are part of the attack surface.
Organizations should consider:
- allowing only approved extensions
- blocking unmanaged extension installs
- reviewing extension permissions
- monitoring changes to installed extensions
- checking for suspicious C2 domains and indicators of compromise
- watching for unusual browser redirects
- detecting injected ads or affiliate hijacking
- reviewing cookie theft and session hijacking indicators
- monitoring access to sensitive apps after extension removal
- enforcing phishing-resistant authentication
Security teams should also treat extension stores as useful but not perfect trust boundaries.
An extension being available in a store does not mean it is safe forever.
Final Thoughts
StegoAd shows how mature malicious browser extension operations have become.
The campaign combined ordinary-looking utilities, delayed execution, steganography, server-side evasion, ad fraud, credential theft, cookie exfiltration, cloud abuse, and long-term infrastructure management.
The result was a campaign that could sit inside a trusted browser extension store for years while hiding its true behavior.
The lesson is clear: browser extensions should be treated like installed software with real access to user data.
If an extension can read pages, modify traffic, inject scripts, or control browser behavior, it can become much more than a convenience tool.
