← Threat Library
high malicious update chromeedge

RedDirection

Legitimate, long-clean Chrome and Edge extensions turned malicious via routine auto-updates. Koi found 18 (~2.3M users); Spin.AI expanded the same campaign to 36 extensions and ~16.5M users.

Disclosed July 8, 2025
Blast radius ~16.5M users
Status delisted

Overview

RedDirection weaponized previously-clean browser extensions by pushing malware in routine version updates. The extension code was clean for years before the malicious update landed on the existing install base.

Payload

Captured the URL of every page visited and exfiltrated it with a unique tracking ID to a C2 server, enabling browser hijacking, redirection to attacker-controlled sites, and credential theft via fake banking pages.

IOC note

No file hashes were published for this campaign — only extension IDs and install counts. The exact malicious version per extension was not disclosed (malware was injected across updates), so versions are left open.

Affected extensions (36)

NameStoreIDMalicious versionArchived
2048 Gamechromeiabflonngmpkalkpbjonemaamlgdghea—no
Adblock Unlimited - Adblockerchromejiaopkfkampgnnkckajcbdgannoipcne—no
Image Downloader - Save pictureschromedaeljdgmllhgmbdkpgnaojldjkdgkbjg—yes
Web Music Downloaderchromedmbjkidogjmmlejdmnecpmfapdmidfjg—no
Super Mario Bros Gamechromepegfdldddiilihjahcpdehhhfcbibipg—no
Video downloader - download any videochromekfpgookelklhphhnihipmknjdgbeecgj—no
Screen Capturechromepmnphobdokkajkpbkajlaiooipfcpgio—no
Dictionary all over with Synonymschromeahjhlnckcgnoikkfkfnkbfengklhglpg—no
Multi Chat - Messenger for WhatsAppchromedllplfhjknghhdneiblmkolbjappecbe—yes
Video Downloader Onlinechromejglemppahimembneahjbkhjknnefeeio—no
PiP (Picture in picture)chromenalkmonnmldhpfcpdlbdpljlaajlaphh—yes
Mute Tab - Silent in a clickchromeinhefjomnpfkkegfklclbjhkifmpkkmn—no
Dark Mode for Chromechromejhhjdfldilccfllhlbjdlhknlfbhpgeg—no
Good Video Downloaderchromemhpcabliilgadobjpkameggapnpeppdg—no
Flash Player Enablerchromeeplfglplnlljjpeiccbgnijecmkeimed—no
Auto HD & Additions for Youtubechromelagdcjmbchphhndlbpfajelapcodekll—no
What Font - find fontchromeacpcapnaopbhbelhmbbmppghilclpkep—no
Floating Video with Playback Controlschromepnanegnllonoiklmmlegcaajoicfifcm—yes
Emoji keyboard onlinechromekgmeffmlnkfnjpgmdndccklfigfhajen—no
Free Weather Forecastchromedpdibkjjgbaadnnjhkmmnenkmbnhpobj—no
Video Speed Controller - Video managerchromegaiceihehajjahakcglkhmdbbdclbnlf—no
Unlock Discord - VPN Proxychromemlgbkfnjdmaoldgagamcnommbbnhfnhf—no
Dark Theme - Dark Reader for Chromechromeeckokfcjbjbgjifpcbdmengnabecdakp—no
Volume Max - Ultimate Sound Boosterchromemgbhdehiapbjamfgekfpebmhmnmcmemg—no
Unblock TikTokchromecbajickflblmpjodnjoldpiicfmecmif—no
Unlock YouTube VPNchromepdbfcnhlobhoahcamoefbfodpmklgmjm—no
Color Picker, Eyedropper - Gecochromeeokjikchkppnkdipbiggnmlkahcdkikp—no
Weatherchromeihbiedpeaicgipncdnnkikeehnjiddck—no
Unlock TikTokedgejjdajogomggcjifnjgkpghcijgkbcjdi—no
Volume Booster - Increase your soundedgemmcnmppeeghenglmidpmjkaiamcacmgm—no
Web Sound Equalizeredgeojdkklpgpacpicaobnhankbalkkgaafp—no
Header Valueedgelodeighbngipjjedfelnboplhgediclp—no
Flash Player - games emulatoredgehkjagicdaogfgdifaklcgajmgefjllmd—no
Youtube Unblockededgegflkbgebojohihfnnplhbdakoipdbpdm—no
SearchGPT - ChatGPT for Search Engineedgekpilmncnoafddjpnbhepaiilgkdcieaf—no
Unlock Discordedgecaibdnkmpnjhjdfnomfhijhmebigcelo—no

Indicators of compromise (1)

domainadmitclick.netC2 / URL exfil + redirect

Sources