Microsoft removes 119 Edge extensions hiding malware in images and

Microsoft removed 119 Edge browser extensions that concealed malware inside image and font files, a campaign Microsoft labels “StegoAd” and ties to a single threat actor active since at least 2021 [1]. The takedown eliminates a potential attack surface for up to 2.6 million users and underscores the difficulty of spotting steganographic payloads in popular add‑ons.

How the extensions worked

The extensions—ranging from ad blockers and VPNs to translators and video downloaders—functioned normally and earned positive reviews, allowing them to linger in the Edge Add‑ons store for years. Each carried dormant malicious code that activated only after passing a series of evasion checks, a delay that let the payload “wake up” days after install [1]. Early variants appended JavaScript after the IEND marker of a PNG icon; later versions switched to WebP images and WOFF2 font files, embedding code in glyph ranges that appear as Asian text or font metadata. Microsoft notes that such large‑scale steganography is rare in the browser‑extension ecosystem [1].

Impact and scope

The hidden payloads served two primary goals. First, they injected ads and hijacked affiliate links on sites such as Amazon, eBay and AliExpress, generating illicit revenue for the operators. Second, they stole credentials—including Google passwords, two‑factor codes, and WordPress admin logins—and exfiltrated cookies for session hijacking [1]. Microsoft’s analysis also found seven Google Analytics IDs used as covert telemetry, giving the actor near‑real‑time visibility into the campaign [1]. The operation employed more than ten command‑and‑control domains, leveraged Cloudflare Workers and GitHub Pages for hosting, and migrated from Manifest V2 to V3 as Edge evolved [1].

Market reaction

Microsoft’s removal of the extensions coincided with a modest dip in its stock price on the day of the announcement [2]. While the share movement reflects investor sensitivity to security incidents, the broader impact is limited to Edge users, as the extensions have now been taken down and the 90‑plus developer accounts behind them suspended [1]. The episode highlights the ongoing challenge for browser stores to vet add‑ons that appear benign but embed malicious code in non‑executable assets.

What to watch

• Extension audit rollout – Microsoft may expand its review process for Edge add‑ons, potentially affecting future developer submissions.
• Threat actor activity – Indicators of compromise released by Microsoft could surface in other Chromium browsers, signaling whether the campaign migrates elsewhere.
• Edge market share – Any shift in user confidence could influence Edge’s adoption relative to Chrome and Firefox in the coming quarters.

The removal of the 119 StegoAd extensions removes a sizable covert attack vector, but the actor’s infrastructure and use of common asset types suggest the technique could reappear in other browsers or future extensions, keeping the security community on alert.