4 ms·
4.3M Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign
- ipnon 10mo agoThe builtin JavaScript interpreter is such a devious touch. No one blinks an eye at several MBs of extension data. That’s plenty of room to store arbitrary runtimes in, and then all the default browser runtime protections are pointless.
- chatmasta 10mo agoThe runtime protections aren’t pointless. The interpreter makes it difficult to inspect the malicious code during execution, but it doesn’t circumvent any sandboxing of the browser.
- payphonefiend 10mo agoPainful read, this reads like it was written by AI.
- OsrsNeedsf2P 10mo agoKept feeling like it was about to say something interesting, but by half way through nothing else was said
- stevekemp 10mo agoI flag posts like this.
- mzs 10mo agosimple human written summary: https://www.theregister.com/2025/12/01/chrome_edge_malicious_browser_extensions/ https://www.theregister.com/2025/12/01/chrome_edge_malicious...
- deleted 10mo ago[deleted]
- VladVladikoff 10mo agoThe line is becoming very blurred to me, I did not really notice.
- nenxk 10mo agoThis line was what tipped me off. “This isn't malware with a fixed function. It's a backdoor.”
- pogue 10mo agoWhat about that sentence is sus to you? I'm not sure if I'm missing another AI tell I'm not aware of or what.
- RicoElectrico 10mo agoSeems very similar to not only X, but also Y
- burkaman 10mo agoSeems to be company policy. They had another article here recently that was just as bad: https://news.ycombinator.com/item?id=45647853 https://news.ycombinator.com/item?id=45647853
- gudzpoz 10mo agoThe WeTab / Infinity team has responded to this [1] (in Chinese). Basically, they argue that: - The Clean Master extension has long been sold, and the malicious updated was not pushed by them. - The other two mentioned extensions are not at all malicious. They collect use info for extension opt-out-able features and analytics (using Google Analytics and Baidu Analytics). - They are communicating with the extension stores to restore their extension. Let's hope it's not an AI company making AI-generated accusations. [1] https://mp.weixin.qq.com/s/E8YQLWZFM2J7r5DZNSl47w https://mp.weixin.qq.com/s/E8YQLWZFM2J7r5DZNSl47w & https://www.v2ex.com/t/1176484 https://www.v2ex.com/t/1176484
- gkbrk 10mo agoThe first point isn't meaningful from a user's perspective. There's no difference between me trusting you and you pushing malware to me vs you selling your deploy access to a third party and the third party pushing malware to me. Especially if selling the extension doesn't remove the old one from the browser automatically and reset it's rating to 0, download count to 0 and remove all the comments/reviews.
- sionisrecur 10mo agoI think in the chrome extension store you can't even change the email account attached to the extension. The only correct way to transfer an extension seems to be deleting it and having the new party create a new one.
- badmonster 10mo ago[flagged]
- supriyo-biswas 10mo agoCan you please stop with the LLM comments? Thank you.
- huydotnet 10mo agoI came to the article hoping to see the list of affected extensions, so I can check if I ever installed any of them. All I get was a list of extension ID at the very bottom of the post. Is this some sort of security practice to not promoting malicious packages or something?
- notepad0x90 10mo agoyou can search your file system for those extension id's , it will be a directory name.
- technion 10mo agoIts more about the likely target audience: i can scan the whole enterprise and activate blocks with those ids.
- huydotnet 10mo agoThat's my first thought, but it would still be helpful to have a list of names, since many people has switched browsers many times in the past, or used many different devices personally.
- kanemcgrath 10mo agoI made a list of the extension names here https://pastebin.com/eXb9GRjK https://pastebin.com/eXb9GRjK its mostly Homepage Wallpapers
- gnatman 10mo agoI was hoping to see a revenue estimate for injecting affiliate links on 4M browsers for 7 years… that must’ve been a lot of money!
- pogue 10mo agoSo, has someone found or compiled a list of the actual extension names, not just IDs?
- creatonez 10mo ago> Koi researchers have identified a threat actor we're calling ShadyPanda Is it that hard to come up with a name that isn't a generic orientalist trope?