ShadyPanda's Seven-Year Campaign Infects 4.3M Chrome and Edge Users

ShadyPanda ran a seven-year campaign that used legitimate-seeming Chrome and Edge extensions to amass large install bases, then pushed malicious updates in 2024 that introduced remote code execution and spyware functionality. The operation infected an estimated 4.3 million users (including ~3 million from a single Edge extension), logged URLs, search terms, mouse clicks, keystrokes, cookies and full browser fingerprints, and exfiltrated encrypted browsing histories to servers reportedly in China; Microsoft removed the identified Edge extensions after publication.