Malicious browser extensions: the quiet credential drain in the web store
A browser extension arrives with more trust than almost any other software a user installs. It gets a standing place inside the session, often with permission to read and change data on every site visited. That trust is exactly what malicious extension authors monetize, and a string of documented campaigns shows store listings that look like ordinary tools quietly working as credential drains.
What an extension can reach
The reach is set by the permissions a user approves. Kaspersky researchers list the sweep: cookies, passwords and payment card details taken from web forms, clipboard contents, screenshots, even keystrokes captured like a keylogger. Real campaigns match the list. Socket, a supply-chain security firm, documented more than 100 malicious Chrome Web Store extensions in April 2026; 54 of them used the chrome.identity.getAuthToken call to harvest Google OAuth2 bearer tokens, which let the operator act as the user, and one extension pulled Telegram Web session data from local storage every fifteen seconds and could overwrite the victim's session with attacker-supplied data. A second listing that survived for years: in December 2025, BleepingComputer reported two Chrome Web Store extensions named Phantom Shuttle, sold for $1.4 to $13.6 as proxy-testing tools for users in China and active since at least 2017. The extensions rerouted more than 170 high-value domains through attacker-controlled proxies, then captured form submissions, read session cookies out of HTTP headers and extracted API tokens while acting as a man-in-the-middle. Both were still listed when the report was published. Store listings and the loaders that skip them
The scale is not marginal. According to Kaspersky's summary of 2020 data, Google removed 106 data-stealing Chrome extensions with a combined 32 million downloads, affecting networks in finance, oil and gas, healthcare and government. The Socket campaign shows the format is still active: the extensions hid behind five publisher identities and categories ranging from Telegram clients to slot games and video enhancers, and 45 of them contained a hidden startup function that fetched commands from attacker infrastructure. Not every malicious extension passes a store review at all. Trend Micro's November 2023 report on ParaSiteSnatcher documented a modular, heavily obfuscated framework delivered by a VBScript downloader hosted on Dropbox and Google Cloud. After registering the victim and retrieving obfuscated command-and-control URLs, the installer deleted the browser's shortcuts and created new ones that load the extension, locking in persistence. The extension intercepted POST requests containing account data before they left the browser, monitored balances, manipulated PIX transactions at Brazilian banks, and stole cookies, including Microsoft live.com cookies usable for pass-the-cookie attacks against cloud accounts. The review gap: approval covers the upload, not the future
Store review examines the package a developer uploads. It cannot examine what the same extension will do months later. Kaspersky notes that extensions auto-update, so a legitimate add-on can be turned malicious after the fact: the Particle extension was sold and updated to inject ads, reaching more than 30,000 users before it was stopped. Remote-hosted code pushes this further, because a package that fetches its real logic from a server at runtime is, in practice, unreviewable. Manifest V3 is Google's structural answer: extensions must bundle all the code they execute inside the reviewed package, and remote hosted code, JavaScript or WebAssembly loaded from outside it, is rejected, including dead code paths that could load it. The rationale is precisely the post-approval problem: code that can change after review defeats review. The exceptions are narrow, covering user-script managers, the debugger interface and sandboxed iframes. The Socket finding that 45 extensions fetched runtime commands from a central server shows the behavior the rule targets, and why listing checks alone miss it. Practical defense
The routine is unglamorous. Audit the installed extension list periodically and remove anything unrecognized or unused; Socket published the extension IDs from its campaign so users could compare their own list against known-bad entries. Keep the total count low, because every install is a standing grant that renews silently. Treat permission creep as a red flag, Kaspersky's example being a calculator that requests geolocation or browsing history. Favor extensions with a stable publisher and a small, explicable permission set over whatever ranks first in store search. Compartmentalize: a separate browser profile for banking and account administration limits what any single add-on can reach, and the same logic drives enterprises to block or force-install store extensions on managed devices. The prize is the authenticated session, the same target mobile banking trojans like ToxicPanda pursue, approached from inside the browser instead of through an overlay on the screen. An extension asks for less attention than a phishing email and, for the operator, pays comparably. The documented campaigns differ in delivery, whether store listing, auto-update, dropper and shortcut, but they share the shape: gain listing, gain trust, wait, then drain credentials from a position the user never sees.
