Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts

Microsoft dismantled a long-running malicious extension campaign called "StegoAd" that hid JavaScript payloads inside images and WOFF2 fonts to evade detection; 119 Edge extensions tied to a single operator were removed, with a combined install base up to 2.6 million. The extensions performed ad fraud and stole credentials, 2FA codes, WordPress admin logins and cookies, delivered a remote code execution backdoor, and used resilient C2 infrastructure and evasion checks (delays, fingerprinting, Cloudflare Workers, GitHub Pages). Microsoft published indicators of compromise and recommends users compare installed extensions to the removal list, change sensitive passwords, review sign-ins, and enable strong two-factor authentication.