RedDirection
Legitimate, long-clean Chrome and Edge extensions turned malicious via routine auto-updates. Koi found 18 (~2.3M users); Spin.AI expanded the same campaign to 36 extensions and ~16.5M users.
Overview
RedDirection weaponized previously-clean browser extensions by pushing malware in routine version updates. The extension code was clean for years before the malicious update landed on the existing install base.
Payload
Captured the URL of every page visited and exfiltrated it with a unique tracking ID to a C2 server, enabling browser hijacking, redirection to attacker-controlled sites, and credential theft via fake banking pages.
IOC note
No file hashes were published for this campaign — only extension IDs and install counts. The exact malicious version per extension was not disclosed (malware was injected across updates), so versions are left open.
Affected extensions (36)
| Name | Store | ID | Malicious version | Archived |
|---|---|---|---|---|
| 2048 Game View analysis | chrome | iabflonngmpkalkpbjonemaamlgdghea | — | no |
| Adblock Unlimited - Adblocker View analysis | chrome | jiaopkfkampgnnkckajcbdgannoipcne | — | no |
| Image Downloader - Save pictures View analysis | chrome | daeljdgmllhgmbdkpgnaojldjkdgkbjg | — | yes |
| Web Music Downloader View analysis | chrome | dmbjkidogjmmlejdmnecpmfapdmidfjg | — | no |
| Super Mario Bros Game View analysis | chrome | pegfdldddiilihjahcpdehhhfcbibipg | — | no |
| Video downloader - download any video View analysis | chrome | kfpgookelklhphhnihipmknjdgbeecgj | — | no |
| Screen Capture View analysis | chrome | pmnphobdokkajkpbkajlaiooipfcpgio | — | no |
| Dictionary all over with Synonyms View analysis | chrome | ahjhlnckcgnoikkfkfnkbfengklhglpg | — | no |
| Multi Chat - Messenger for WhatsApp View analysis | chrome | dllplfhjknghhdneiblmkolbjappecbe | — | yes |
| Video Downloader Online View analysis | chrome | jglemppahimembneahjbkhjknnefeeio | — | no |
| PiP (Picture in picture) View analysis | chrome | nalkmonnmldhpfcpdlbdpljlaajlaphh | — | yes |
| Mute Tab - Silent in a click View analysis | chrome | inhefjomnpfkkegfklclbjhkifmpkkmn | — | no |
| Dark Mode for Chrome View analysis | chrome | jhhjdfldilccfllhlbjdlhknlfbhpgeg | — | no |
| Good Video Downloader View analysis | chrome | mhpcabliilgadobjpkameggapnpeppdg | — | no |
| Flash Player Enabler View analysis | chrome | eplfglplnlljjpeiccbgnijecmkeimed | — | no |
| Auto HD & Additions for Youtube View analysis | chrome | lagdcjmbchphhndlbpfajelapcodekll | — | no |
| What Font - find font View analysis | chrome | acpcapnaopbhbelhmbbmppghilclpkep | — | no |
| Floating Video with Playback Controls View analysis | chrome | pnanegnllonoiklmmlegcaajoicfifcm | — | yes |
| Emoji keyboard online View analysis | chrome | kgmeffmlnkfnjpgmdndccklfigfhajen | — | no |
| Free Weather Forecast View analysis | chrome | dpdibkjjgbaadnnjhkmmnenkmbnhpobj | — | no |
| Video Speed Controller - Video manager View analysis | chrome | gaiceihehajjahakcglkhmdbbdclbnlf | — | no |
| Unlock Discord - VPN Proxy View analysis | chrome | mlgbkfnjdmaoldgagamcnommbbnhfnhf | — | no |
| Dark Theme - Dark Reader for Chrome View analysis | chrome | eckokfcjbjbgjifpcbdmengnabecdakp | — | no |
| Volume Max - Ultimate Sound Booster View analysis | chrome | mgbhdehiapbjamfgekfpebmhmnmcmemg | — | no |
| Unblock TikTok View analysis | chrome | cbajickflblmpjodnjoldpiicfmecmif | — | no |
| Unlock YouTube VPN View analysis | chrome | pdbfcnhlobhoahcamoefbfodpmklgmjm | — | no |
| Color Picker, Eyedropper - Geco View analysis | chrome | eokjikchkppnkdipbiggnmlkahcdkikp | — | no |
Weather | chrome | ihbiedpeaicgipncdnnkikeehnjiddck | — | no |
Unlock TikTok | edge | jjdajogomggcjifnjgkpghcijgkbcjdi | — | no |
Volume Booster - Increase your sound | edge | mmcnmppeeghenglmidpmjkaiamcacmgm | — | no |
Web Sound Equalizer | edge | ojdkklpgpacpicaobnhankbalkkgaafp | — | no |
Header Value | edge | lodeighbngipjjedfelnboplhgediclp | — | no |
Flash Player - games emulator | edge | hkjagicdaogfgdifaklcgajmgefjllmd | — | no |
Youtube Unblocked | edge | gflkbgebojohihfnnplhbdakoipdbpdm | — | no |
SearchGPT - ChatGPT for Search Engine | edge | kpilmncnoafddjpnbhepaiilgkdcieaf | — | no |
Unlock Discord | edge | caibdnkmpnjhjdfnomfhijhmebigcelo | — | no |
Indicators of compromise (1)
| domain | admitclick.net | C2 / URL exfil + redirect |