Malware force-installs Chrome extensions on 300,000 browsers, patches DLLs

An ongoing, large-scale campaign uses digitally signed fake installers and PowerShell scripts to force-install malicious Google Chrome and Microsoft Edge extensions in over 300,000 browsers; these extensions hijack searches, steal browsing history and credentials, and persist by creating scheduled tasks, adding registry policies, modifying browser shortcuts and DLLs to prevent updates and hide from extension managers. ReasonLabs and BleepingComputer documented the IOCs, listed affected extensions, and provided manual cleanup guidance including removing scheduled tasks, registry ForceInstall entries, and the malicious PowerShell files.