4.3 Million Chrome and Edge Users Hacked in 7-Year ShadyPanda Malware Campaign

**ShadyPanda** executed a seven‑year campaign by publishing and maintaining legitimate Chrome/Edge extensions (e.g., "Clean Master", "WeTab") to gain trust and user base, then pushed silent malicious updates that turned those extensions into hourly RCE agents. The compromised extensions (impacting ~4.3M users) fetched and executed arbitrary JavaScript from a command-and-control endpoint (api.extensionplay.com), enabling dynamic payloads and large-scale exfiltration of URLs, keystrokes, cookies, device fingerprints, and behavioral biometrics to servers in China and private infrastructure.