Firefox joins Chrome and Edge as sleeper extensions spy on users

DarkSpectre-operated campaigns (ShadyPanda, GhostPoster, Zoom Stealer) abused browser extensions published in official stores to deploy spyware: researchers found JavaScript payloads hidden via steganography inside extension images and other assets, enabling extensive user tracking and potential credential/session theft; an initial set of compromised extensions impacted tens of thousands of users and an additional 17 extensions were downloaded over 840,000 times and remained active for years, vendors have removed the add-ons but installed extensions must be manually removed and the report includes remediation guidance (Malwarebytes Deep Scan and manual checks).