“Sleeper” browser extensions woke up as spyware on 4 million devices

Researchers uncovered a seven‑year 'sleeper' campaign where five Chrome/Edge extensions (≈4.3M installs, including WeTab ~3M on Edge) behaved normally for years before silent updates in mid‑2024 turned them into a remote code execution framework that downloads and runs arbitrary JavaScript (polling api.extensionplay.com hourly) and streams visited URLs, searches, and browser data back to attackers attributed to ShadyPanda; Google removed the extensions but Edge store versions remained available and researchers published a list of extension IDs and mitigation steps.