Zentos malware
1 browser extension(s) named as malware in an outside report.
Explore campaign →← Campaign explorer
Research
Investigations and evidence behind the campaigns we track.
Easy Package Tracker malware
1 browser extension(s) named as malware in an outside report.
Explore campaign →View Driving Directions malware
1 browser extension(s) named as malware in an outside report.
Explore campaign →View Earth Satellite Maps malware
1 browser extension(s) named as malware in an outside report.
Explore campaign →searchjacked
23 browser extension(s) named as search hijacking in an outside report.
Explore campaign →BaseDex malware
1 browser extension(s) named as malware in an outside report.
Explore campaign →Fb Multi Manager malware
1 browser extension(s) named as malware in an outside report.
Explore campaign →SelectorsHub Opens Remote-Controlled Ad Tabs Without Asking
SelectorsHub, a Chrome developer tool with about 400,000 users, fetches ad URLs from selectorshub.info and opens them in background tabs on install and update, with destinations the operator rotates server-side.
Explore campaign →Pomodoro Search Hijacker
The Pomodoro Chrome extension with 80,000 installs silently replaces the default search engine with pomodorosearch.com, redirecting all searches through a tracking parameter while shipping no timer functionality.
Explore campaign →The "VPN for X" Proxy Farm
A cluster of 31 Russian-language "VPN for X" Chrome extensions from three linked publisher accounts, sharing one codebase that routes browser traffic through a proxy whose server list is fetched from a remote source after install.
Explore campaign →KREMLIN Banking Malware
A sideloaded Chrome/Edge banking trojan targeting Portuguese-speaking Brazilian users. Forges Secure Preferences HMACs to bypass Chrome extension integrity checks, keylogs and intercepts webRequest bodies, and exfiltrates over a WebSocket C2 whose configuration is resolved from an Ethereum smart contract dead-drop. Not distributed through any official extension store. Reported by Elastic Security Labs (REF9334), 2026-09-14.
Explore campaign →Active8 Search Engine Takeover and Affiliate Redirect
Active8 (100,000+ users) silently overrides the browser's default search engine, sending all queries to y.activate-tab.com and redirecting to Yahoo with affiliate parameters, monetizing users' searches without disclosure.
Explore campaign →Troywell VPN Lite Remote PAC Script Injection
Troywell VPN Lite installs a PAC script fetched from its operator's server, letting that server redirect all browser traffic; remove the extension and treat accounts used while it was active as potentially exposed.
Explore campaign →Spotify Ad Blocker - Blockify Remote Configuration and Uninstall Tracking
This extension fetches a remote configuration that controls script injection and sets a unique uninstall URL to track users, affecting approximately 400,000 users.
Explore campaign →USPS Tracking Extension Search Hijacking to trackingnumbers.org
The USPS Tracking extension silently sets default search to trackingnumbers.org and sends install pings, affecting ~50,000 Chrome users.
Explore campaign →Predator Search: Persistent Search Hijacking with Session Tracking
Predator Search (50,000 Chrome users) redirects all address-bar searches to predatorwallpaper.com and tags each query with a persistent session ID that is reported to the operator, so remove it and be aware that your search data is tied to a re-identifiable identifier.
Explore campaign →StreamTube Proxy: Remote-Controlled YouTube Proxy Routing Through Operator Server
StreamTube Proxy routes all YouTube traffic through a hardcoded proxy (193.233.165.68:63228) whose server list and API base can be changed remotely by the operator, giving them visibility into users' YouTube activity; remove the extension if you don't trust the operator.
Explore campaign →Count Dooku
Supply-chain campaign that re-published legitimate VS Code extensions to Open VSX with a malicious JavaScript IIFE appended after the source-map comment — placed outside the source map so casual review and diff tools miss it. The injected payload beacons to a hard-coded C2. Tracked by opensourcemalware.com.
Explore campaign →Earth Search for Chrome: Search Hijacking and Silent Tracking
Earth Search for Chrome overrides the default search engine to earthsearchforchrome.com and sends installation and uninstallation data, including a unique ID and user agent, affecting roughly 60,000 users.
Explore campaign →Captain Products Ad Network
Long-clean Chrome extensions bought through developer-account handoffs, then updated to inject an ad banner beaconing to a throwaway Cloudflare Worker. Eight confirmed carriers (~560k installs); every banner funnels users to one clean 200k-install extension that is the network's real payout.
Explore campaign →Easy PDF Viewer Search Hijack and Persistent Tracking
Easy PDF Viewer (Chrome, ~50,000 installs) overrides the default search engine to easypdfviewer.net and sets a respawning 5-year tracking cookie; remove it and clear cookies for that domain.
Explore campaign →OmniSearch browser extension hijacks default search and sends telemetry to Lavasoft
OmniSearch changes the default search engine to defaultsearch.co and sends install ID, timestamps, and browser data to Lavasoft servers, impacting approximately 80,000 users.
Explore campaign →View Package Tracking search hijacker
The View Package Tracking Chrome extension (50,000 users) silently redirects the default search engine to viewpackagetracking.com and reports installation data to the same domain.
Explore campaign →Better Search Hijacks Default Search and Redirects Queries to getbettersearch-api.com
Better Search (Chrome, 200,000+ users) replaces the default search provider and redirects every search query through search.getbettersearch-api.com with a per-install GUID, allowing the operator to control search traffic.
Explore campaign →Twenty More Chrome Extensions Take Over the Default Search Engine
Twenty Chrome extensions, from map and recipe helpers to cat and wallpaper themes, make their own server the default search engine, so every address-bar search passes through a host the publisher controls. About 132,000 installs.
Explore campaign →NewTab. Search Chrome Extension Search Hijacking to Affiliate Redirect
Installing NewTab. Search changes Chrome's default search engine to newtab.club, which redirects queries to an affiliate-monetized landing page (src=PN1005) without user disclosure.
Explore campaign →Quick Search Tool Search Provider Hijack and Tracking
Chrome extension 'Quick Search Tool' (100,000 users) silently sets itself as default search engine, adds affiliate tracking to every query, logs installs with a persistent user ID, opens monetized tabs, and closes its own Chrome Web Store review page to hide user feedback.
Explore campaign →Wanderlustar Search and New Tab Hijacking
The Wanderlustar Chrome extension overrides the default search engine and new tab page to redirect traffic to wanderlustar.com with tracking parameters, affecting approximately 50,000 users; remove it and review search settings.
Explore campaign →Gameograf and Ovkas Wallpaper Extensions Push Affiliate Traffic and Remote Popups
Over 400 live-wallpaper and new-tab Chrome extensions published under the Gameograf and Ovkas names open affiliate-tracked pages on install, report uninstalls to the operator, pull popup HTML from api.gameograf.com, and in some builds delete the browser IndexedDB.
Explore campaign →WaSteal (wascript.com.br) White-Label WhatsApp Data Collection Network
A white-label WhatsApp Web CRM platform (internal name watidy) published under dozens of independent-looking Brazilian brands. Every variant shares one codebase, one backend (*.wascript.com.br) and one platform key, silently uploads voice notes for server-side conversion, exfiltrates PII plus Facebook/Google/TikTok advertising cookies to per-reseller webhooks every 24 hours, and loads runtime JavaScript from actor-controlled hosts - including a live Google Tag Manager container in WaSeller that is a permanent remote-code channel. Independently verified against CVEQ archives 2026-08-22.
Explore campaign →Netflix Picture-in-Picture Extension Bundles Default-On Telemetry SDK
The 'Netflix Picture in Picture now for Prime & D+ [QVI]' Chrome extension with ~200,000 users bundles a telemetry SDK that reports install and usage data to me3x.online and metricsmint.quest unless users opt out; consider blocking or removing it if this data sharing is not desired.
Explore campaign →Urban Browser Guard Sends ChatGPT Conversations to Vendor Endpoint
Urban Browser Guard reads ChatGPT conversations and can transmit the chat text to guardrail.urban-vpn.com after user consent, affecting 300,000 Chrome users.
Explore campaign →GlassWorm
First self-propagating worm using invisible-Unicode code; hit OpenVSX and the VS Code Marketplace, harvested NPM/GitHub/OpenVSX/Git credentials and 49 crypto wallets, and deployed the ZOMBI RAT.
Explore campaign →Shai-Hulud
Self-replicating npm worm (Sept 2025, plus v2.0 Nov 2025 and Mini Shai-Hulud May 2026). Used TruffleHog to steal cloud/AI credentials; later waves explicitly targeted Claude Code / MCP config files.
Explore campaign →RedDirection
Legitimate, long-clean Chrome and Edge extensions turned malicious via routine auto-updates. Koi found 18 (~2.3M users); Spin.AI expanded the same campaign to 36 extensions and ~16.5M users.
Explore campaign →Auto Refresh Plus Browsing History Exfiltration
Auto Refresh Plus, a Chrome extension with 100,000 users, sends visited URLs and referrers to the developer's server without disclosure.
Explore campaign →Rewards Search Automator CDP debugger and <all_urls> account-ban risk
Rewards Search Automator (60,000 users) attaches the Chrome DevTools Protocol debugger to Bing tabs and requests <all_urls> access, automating searches in a way that can get Microsoft Rewards accounts banned; remove it if you value your account.
Explore campaign →YesCaptcha Assistant All-URL Page Data Collection
YesCaptcha Assistant (90,000+ users) reads every HTTP(S) page, captures visible screenshots, and sends cookies to vendor API endpoints via an all_urls permission and fetch with credentials, a risk-by-design data flow without hidden credential theft.
Explore campaign →Cyberhaven / GraphQL Network Inspector
OAuth-phishing of extension developers led to malicious updates. GraphQL Network Inspector v2.22.6 injected credential/session-stealing JS. The only Chrome-extension incident with published file hashes.
Explore campaign →STIX 2.1 research feed · Free for internal security use with attribution, under our terms.