17 New Malicious Chrome GhostPoster Extensions with 840,000+ Installs Steals User Data

GhostPoster is a coordinated campaign that pushed 17 malicious browser extensions across Chrome, Firefox, and Edge with over 840,000 collective downloads; the extensions hid encrypted payloads inside PNG images (steganography), used delayed activation to evade store reviews, and at runtime decoded and fetched scripts that stole credentials and personal data, hijacked affiliate links, injected tracking code, and manipulated security-related HTTP headers. LayerX Security linked the extensions to a common infrastructure, indicating a sustained, financially motivated operation that persisted for up to five years before discovery.