← Campaigns
RedDirection
Legitimate, long-clean Chrome and Edge extensions turned malicious via routine auto-updates. Koi found 18 (~2.3M users); Spin.AI expanded the same campaign to 36 extensions and ~16.5M users.
- Extensions
- 36
- Stores
- Chrome, Edge
- Updated
- 2025-07-08
- Disclosed
- 2025-07-08
Member extensions
36 extensions| Extension | Store | Reported versions | Current risk |
|---|---|---|---|
| 2048 Gameiabflonngmpkalkpbjonemaamlgdghea | Chrome | Not specified | Unscored |
| Adblock Unlimited - Adblockerjiaopkfkampgnnkckajcbdgannoipcne | Chrome | Not specified | 57.76MEDIUM |
| Image Downloader - Save picturesdaeljdgmllhgmbdkpgnaojldjkdgkbjg | Chrome | Not specified | 53.25MEDIUM |
| Web Music Downloaderdmbjkidogjmmlejdmnecpmfapdmidfjg | Chrome | Not specified | Unscored |
| Super Mario Bros Gamepegfdldddiilihjahcpdehhhfcbibipg | Chrome | Not specified | Unscored |
| Video downloader - download any videokfpgookelklhphhnihipmknjdgbeecgj | Chrome | Not specified | 58.34MEDIUM |
| Screen Capturepmnphobdokkajkpbkajlaiooipfcpgio | Chrome | Not specified | Unscored |
| Dictionary all over with Synonymsahjhlnckcgnoikkfkfnkbfengklhglpg | Chrome | Not specified | Unscored |
| Multi Chat - Messenger for WhatsAppdllplfhjknghhdneiblmkolbjappecbe | Chrome | Not specified | 35.68LOW |
| Video Downloader Onlinejglemppahimembneahjbkhjknnefeeio | Chrome | Not specified | Unscored |
| PiP (Picture in picture)nalkmonnmldhpfcpdlbdpljlaajlaphh | Chrome | Not specified | 31.18LOW |
| Mute Tab - Silent in a clickinhefjomnpfkkegfklclbjhkifmpkkmn | Chrome | Not specified | Unscored |
| Dark Mode for Chromejhhjdfldilccfllhlbjdlhknlfbhpgeg | Chrome | Not specified | Unscored |
| Good Video Downloadermhpcabliilgadobjpkameggapnpeppdg | Chrome | Not specified | Unscored |
| Flash Player Enablereplfglplnlljjpeiccbgnijecmkeimed | Chrome | Not specified | Unscored |
| Auto HD & Additions for Youtubelagdcjmbchphhndlbpfajelapcodekll | Chrome | Not specified | Unscored |
| What Font - find fontacpcapnaopbhbelhmbbmppghilclpkep | Chrome | Not specified | Unscored |
| Floating Video with Playback Controlspnanegnllonoiklmmlegcaajoicfifcm | Chrome | Not specified | Unscored |
| Emoji keyboard onlinekgmeffmlnkfnjpgmdndccklfigfhajen | Chrome | Not specified | Unscored |
| Free Weather Forecastdpdibkjjgbaadnnjhkmmnenkmbnhpobj | Chrome | Not specified | Unscored |
Indicators
Download STIX →Browse 1 indicators
| Type | Value & evidence |
|---|---|
| domain | admitclick.netC2 / URL exfil + redirect |