Trust Wallet Chrome Extension Breach: $7 Million Crypto Loss

A shocking cybersecurity incident occurred in December 2025, when a serious security bug was detected in the Chrome browser extension of Trust Wallet. With just a short lapse of time, hackers gained direct access to users’ crypto wallets and stole nearly $7 million worth of crypto.

This incident is not just for crypto users, but is a strong warning for every business and digital product – that if even a trusted platform gets compromised, the damage can be huge.

What happened in the incident?

The update of Trust Wallet’s Chrome extension was compromised. Attackers inserted malicious code into the extension through the update process.

Whenever someone updated the extension or imported their seed phrase into the wallet, the hackers immediately took control of their wallet. Once they got the seed phrase, the attackers would withdraw all the money.

The special thing is that the mobile app was completely safe. Only the Chrome browser extension was affected. This was a supply chain attack, not a straight blockchain hack.

What is the impact on users?

Only the Browser Extension (v2.68) had the problem; the mobile app and all other versions were absolutely safe.

Desktop users who imported their seed phrase into the extension will have their crypto funds stolen from their wallets instantly. Many people did not even get the money; the money has already been withdrawn.

Trust Wallet’s answer

Trust Wallet immediately launched a new update (version 2.69) and asked everyone to update now. 

Binance and Trust Wallet announced publicly that whatever loss is incurred, everything will be refunded. Founder Changpeng Zhao also said that the funds will be covered by “SAFU” (Secure Asset Fund for Users), meaning the money is safe.

Trust Wallet

Trust Wallet has announced the compensation process for affected users after the security breach of Chrome Extension v2.68.

If you are impacted by the incident, you will need to fill in a form. Just go to this link (https://be-support.trustwallet.com) and submit your case. This form is important because Trust Wallet will verify the case of every user.

The support team is currently treating the victims’ cases on priority. The review process has already started. Every case is checked carefully, so that both accuracy and security are maintained. It may take some time, but it is necessary to reach the compensation to the right users.

Trust Wallet will also continue to provide regular updates and progress to victims. They have asked users to be patient as the process is quite detailed.

The company has openly said sorry, which shows that they are taking responsibility and trying their best to find a solution.

Trust Wallet

Why was this attack so dangerous?

This attack is so dangerous because the login already trusts the extension. The extension came from a trusted source, so I didn’t think too much and installed the update. So, in this process, users’ sensitive data – like seed phrase – gets directly exposed. Everything happened so quietly that no one even got a clue, no warning, no alert.

One thing becomes clear from here: trust is not enough. Security verification and monitoring are mandatory; this is how it can be done.

If the root cause is found, then the biggest problem is the lack of secure update validation. There was no proper monitoring at runtime. People blindly trusted browser extensions without thinking.

This is the point where companies make mistakes again and again. Third-party tools and extensions are used without proper verification – and then such incidents happen.

Ransom Security Analysis

Trust Wallet’s recent incident is a wake-up call, especially from the ransom security point of view. One thing became clear from this: businesses and users will have to be more prepared for cyber attacks. Some important lessons have been learned: 

Don’t overlook supply chain security.

Pay attention to browser extensions.

Keep your seed phrase/credentials offline.

Have your incident response plan ready.

Take all these things seriously. Now is the time to improve; it is better to be a little cautious today than regret later.

Nowadays, ransomware and supply chain attacks have become a serious problem for all businesses. Get a proper security audit of your systems done by the experts at Ransom Security, check backups, and have a solid incident response plan ready. 

Contact Ransom Security now!

Free advice for ransomware protection

Expert guidance on secure tools and extensions

Immediate response in case of cyber threats

Frequently Asked Questions

What happened in the Trust Wallet Chrome extension breach?

In December 2025, a malicious version of the Trust Wallet Chrome browser extension (version 2.68) was released, which contained harmful code that stole users’ wallet seed phrases (secret recovery keys). Once a user opened the compromised extension and unlocked their wallet, the malicious code sent their seed phrase to the attackers, who then used it to withdraw funds from those wallets – resulting in the theft of approximately $7 million in cryptocurrency. Trust Wallet later released a fixed update (version 2.69) and warned users to disable the affected version.

Which Trust Wallet users were affected by this incident?

The attackers only targeted users who had installed or logged in to the Trust Wallet Chrome extension version 2.68 before the breach came to light – and had actually entered their wallet seed phrase in that version. If you did, you risked losing your wallet. Trust Wallet says approximately 2,596 wallet addresses were directly affected. If you are using an older version or a different browser extension, you will not be affected.

Are mobile app users of Trust Wallet affected?

Mobile app users have nothing to worry about. The security breach only affected the Chrome browser extension, version 2.68. Trust Wallet says that their mobile apps – whether you’re on Android or iOS – as well as any versions that are not Chrome extensions, are safe and will not be affected.

Attacks are evolving: How to protect your business in 2026

Every year, cyber attacks are becoming more dangerous than before. Till a few years ago, hackers used to make do with simple passwords or fake emails. Now the situation is such that by 2026, malware has started penetrating directly into the original software, the supply chain is being attacked, and the attackers enter the system without making any noise – no one even gets a clue.

Simply put, relying on outdated antivirus or generic security tools is now foolish. Businesses need smart and proactive security; the threat is real.

When people say “attacks have changed,” really, the whole picture has changed. Hackers have become smarter now. It is more difficult than ever to catch them. They no longer show any haste; instead, they remain quiet, blend in, and choose their victims carefully, especially those in business.

Often, the attacks are so silent that no one even notices. Everything seems normal on the surface, but deep down, data is being stolen, secret access is being created, or a ransomware attack is being prepared – and no one is even aware of it.

business from new types of cyber threats in 2026

Why Are Cyber Attacks More Dangerous Than Ever?

These days, cyber attacks have taken things to a whole new level.

First off, malware isn’t always obvious anymore; it hides inside real, working software. Attacks don’t always slam the door in your face either; they’re slow and quiet. Developers and users go about their day, thinking everything’s perfectly normal.

Take a look at some examples: Someone sneaks into a malicious npm package. Or maybe a third-party tool you trust gets compromised. Sometimes, you run into APIs that look legit but are actually fake, even though they seem to work just fine. And by the time anyone realizes, the damage has already been done. The data has already disappeared.

How Can Businesses Protect Themselves in 2026?

If you want your business to be secure in 2026, don’t rely solely on outdated security tools. You need to stay ahead of the threats, think about proactive, behavior-driven strategies that are constantly evolving.

What does a security company do?

A professional security company monitors your systems, servers, applications, and cloud environments continuously. This company observes what your software is actually doing, that is, its runtime behavior. If anything unusual occurs, such as data theft, a connection being established with an unknown server, unauthorized access attempts, or the discovery of a hidden backdoor, the company detects these things immediately, in real time.

In-house IT teams usually have their hands full with day-to-day work. Keeping up with every new attack technique? That’s tough. On the other hand, security companies bring a lot more to the table. They’ve got the latest threat intelligence, specialized monitoring tools, seasoned security analysts, and people who know exactly what to do when things go sideways. 

So, what does that mean for you? Faster detection, quicker response, and way less damage to your business.

Why Ransom Security Is a Smart Choice in 2026?

Ransom Security keeps your business safe with real-time protection that keeps up with the latest cyber threats.

Nowadays, cyber attacks have become so smart that simple antivirus software or basic security is no longer enough. If business is to be saved, more is needed. That’s why Ransom Security is the right choice – it comes with not just tools, but a complete security team and system. In 2026, you won’t just need a security tool, you’ll need a complete security partner – and that’s exactly what Ransom Security provides.

Cyber ​​attacks keep changing. Is your security changing with them? Let Ransom Security handle the monitoring, spot trouble early, and shut it down fast. Reach out to our security experts today.

Top Reasons to Choose Expert Security Restoration for Ransomware Incidents

In today’s digital age, ransomware attacks have become a serious threat to businesses. Ransomware is like a digital lock. It locks your computer, files, and systems, and says, “Pay money, only then will you get the data.” These attacks are often caused by: accidentally opening an email, weak passwords, or outdated software. When a ransomware attack occurs, simply running an antivirus is not enough. Here, expert security restoration services play the most important role.

Let’s understand why businesses should choose expert security restoration after a ransomware attack. But first, let’s understand what security restoration actually is.

Top Reasons to Choose Expert Security Restoration for Ransomware Incidents

What is security restoration?

Security restoration restores IT systems and data to normal after a cyberattack, ransomware attack, virus, or data breach. This involves not only repairing what was damaged, but also strengthening everything to prevent further damage from future attacks. When a company faces a major cybersecurity issue, it needs security restoration. Now Let’s understand why businesses should choose expert security restoration after a ransomware attack.

Reasons to Choose Expert Security Restoration

Complete Ransomware Removal: Many people think that ransomware just encrypts files. But in reality, ransomware leaves hidden malware behind, creates backdoors, and installs remote access tools. This means that the hacker does not leave the system completely. Expert security restoration teams perform thorough scanning to completely remove ransomware and its hidden components from the entire network, reducing the risk of future attacks.

Safe & Secure Data Recovery: Paying ransom is always risky. Experts restore data from backup, repair corrupted files, and ensure that the restored data is clean. This allows businesses to get back to work safely without paying ransom.

Business downtime is reduced: When a ransomware attack occurs, systems are shut down, employees are out of work, and the company loses revenue. Simply put, the company’s daily operations come to a halt. When a company’s systems and services don’t work, the longer the downtime, the greater the financial loss, and the greater the loss of customer trust. Experts provide rapid incident response, meaning: control torrent attacks, isolate infected systems, and perform prioritized system restores.

Root Cause Analysis: When a ransomware attack occurs, simply deleting the virus and restarting the system does not completely resolve the problem. This is because it is not clear how the attack happened. Security experts investigate like detectives, and they check:

How did the attack start?

Did this happen through a phishing email or a weak password?

Which system was weak?

When experts determine the cause, they take action: the same email attacks are blocked in the future, password policies are strengthened, and vulnerable systems are secured.

Stronger Security for the Future: Security restoration is not just recovery; most people think that security restoration means the system is fixed, job done. But actually doing MTLB recovery or taking security for the future. Experts fix security vulnerabilities, implement MFA (Multi-Factor Authentication), improve email security and firewall rules, and implement backup strategies. The result is that the company becomes more secure than before.

Read the blog “Security Restoration Services Help Businesses.

Why pick Ransom Security for security restoration? 

Simple. When ransomware hits, rebooting your system isn’t enough. You need people who know how to dig out every last threat and make sure your business stays safe for the long haul. That’s exactly how Ransom Security operates.

Here’s what you get:

– Security restoration from start to finish

– Experts in ransomware and incident response

– Safe data recovery, no ransom payments, ever

– Real root cause analysis to stop attacks at the source

– Stronger security when we’re done, not just a reset

– Business-focused solutions that meet compliance standards

– A partner you can trust, now and in the future

Let’s be clear: using the wrong tools, guessing your way through recovery, or rushing to delete files can wreck your data for good. Worse, you might spread the infection and make things even messier. Taking careful, informed action after a ransomware attack isn’t just smart. It’s necessary.

Real experts don’t just wipe the ransomware. They clean the system, hunt down every hidden threat, recover your data safely, and lock things down tighter than before. So you’re not just patching things up, you’re actually solving the problem.

If your company’s dealing with ransomware, malware, phishing, or a data breach, don’t wait around. Every minute you try to fix things yourself, you risk losing data, losing money, or dragging out downtime. Bring in security professionals right away. The wrong move can wipe your data for good, let the attack happen all over again, or leave sneaky malware behind. Get in touch with ransomware security experts today, and start your recovery the right way.

Frequently Asked Questions

Why do you need expert security restoration after a ransomware attack?

Ransomware is not limited to just locking files. It leaves behind hidden threats, malware, backdoors, and clever remote access tools waiting to strike again. Security experts conduct in-depth investigations, scanning the entire network to eliminate every trace of an attack. They recover your data safely and then lock everything so that you don’t become an easy target next time.

Can you get rid of ransomware without paying money?

Absolutely. Expert teams recover your data from secure backups, repair the damage, and completely clean your system.

How long does it take to recover from ransomware?

It depends on this. If the attack is small and you have good backups, you can recover in a few hours or a day. If there is a bigger problem, then this may take several days. Professionals focus on getting your most important systems up and running first, so you don’t have to wait for everything to happen at once.

Can restoring security prevent future ransomware attacks?

Yes, it really helps. Restoration isn’t just about getting things back to normal. Experts close security holes, set up multi-factor authentication, strengthen email and firewall protection, and put in place smart backup and monitoring systems. All of this makes it very difficult for attackers to get back in.

What should a business do immediately after a ransomware attack?

First, disconnect any infected systems from the network immediately. Don’t start deleting files, don’t reboot, and definitely don’t pay the ransom. Call a security expert immediately. Doing anything yourself could make the situation worse, risking permanent data loss or spreading the attack further.

Active attacks exploit Gladinet’s hard-coded keys for unauthorized access and code execution.

On December 2, Huntress’s support team received an email from a Gladinet customer. The customer reported that Gladinet contacted him on November 30, informed him about the new security issue, and asked him to immediately install the latest update that came out on November 29. Additionally, Gladinet also provided them with Indicators of Compromise (IoCs) to detect whether the system was hacked or not.

As of December 10, Huntress discovered that nine different organizations had become victims of this vulnerability. These companies were from healthcare, technology, and other sectors.

Security researcher Brian Masters clearly stated, “Attackers can exploit this bug to gain access to the web.config file. After this, they can perform deserialization and remote code execution.”

Now let’s talk about what the attacker does.

The attacker’s IP address was: 147.124.216[.]205

First, it used the old exploit CVE-2025-11371.

Subsequently, an exploit of the new vulnerability was run.

His target was to steal the web.config file.

The machineKey of the application resides in this file.

This means that if an attacker gets hold of it, he can easily bypass encryption and validation.

Gladinet released a new update as soon as it received news of the threat and asked customers to install it immediately. Now the advice is – those whose systems are affected should immediately install the new version and change their machineKey to maintain security.

Active attacks exploit Gladinet's hard-coded keys for unauthorized access and code execution.

What is filesvr.dn and how does it work?

filesvr.dn is a custom HTTP handler, configured in web.config. It reads a query parameter ‘t’. ‘t’ is actually an access ticket, which is an encrypted string containing four types of information:

which file to download

Which user to work as?

The password of that user

Ticket expiry time

The server trusts this ticket and grants file access based on its contents.

When the server starts, it generates encryption keys using a function inside GladCtrl64.dll, using the current time, and stores two 100-byte keys in memory.

To generate these keys, the server uses a process:

SysKeyMgr calls a function named AccessKeyMgr64.GetSysEncKey.

This function passes the current system time (e.g., “2025-12-10 14:20:05”) to another function named GenerateSecKey.

GenerateSecKey is inside a file named GladCtrl64.dll.

This function returns two strings, each of which is 100 bytes long.

These two 100-byte strings are then stored in the server’s memory and used as encryption keys.

The system takes an encrypted ticket, sanitizes it, decrypts it using fixed keys, and gets a simple 4-line statement: what file to access, what user to act as, what password to use, and when the ticket was created.

If the ticket is not older than 4 hours and the username/password is correct, the server acts as that user and accesses the file system on that user’s behalf.

Researchers examined how the server creates its encryption keys.

They found:

The GenerateSecKey function (inside GladCtrl64.dll) always returns the same two 100-byte strings every time the server runs. These strings come from:

Used to create a fixed Chinese text → AES key

Used to create a fixed Japanese text → IV (initialization vector)

Found this article interesting, read more exclusive content we post.

React2Shell Vulnerability Exposed: The Truth About Chinese Threat Actors and Cloudflare Outage

Two hacking groups linked to China were quick to exploit a new security vulnerability in React Server Components (RSC). As soon as the vulnerability became public, both groups became active.

A new report from Amazon Web Services (AWS) revealed that two Chinese threat actors, Earth Lamia and Jackpot Panda, tried to take advantage of this critical flaw. Both these names have been involved in cyber attacks before, and this time too, they left no chance.

This vulnerability is known as CVE-2025-55182. People also call it React2Shell. Its special thing is that it allows remote code execution without any authentication. React has fixed this in its versions 19.0.1, 19.1.2, and 19.2.1.

Understanding CVE-2025-55182 (React2Shell)

Lachlan Davidson discovered this vulnerability and reported it to the React team on November 29, 2025. CVE-2025-55182 is a deserialization vulnerability in React Server components. Security researchers have named it React2Shell.

Some important points:

React2Shell Vulnerability Exposed

Vercel informed Meta and other big cloud providers, including AWS, about this vulnerability in time. For this reason, coordinated patching and protection could be deployed before public disclosure.

Who is using CVE-2025-55182?  

Activity recorded on AWS’s Madpot honeypot infrastructure revealed several IP addresses and systems previously linked to China’s state-backed cyberattackers. Interestingly, Chinese attack groups often share anonymity infrastructure among themselves. Therefore, it is difficult to say with certainty which group is behind any one activity. Meanwhile, the names of two groups like “Earth Lamia” and “Jackpot Panda” have definitely surfaced. Now it has also become common that large anonymization networks are used extensively in Chinese cyber operations. 

Artha Lamia is a China-linked cyber threat group that targets organizations in Latin America, the Middle East, and Southeast Asia. These people take advantage of the vulnerabilities of web applications. So far, they have targeted sectors like financial services, logistics, retail, IT companies, universities, and government organizations.

Jackpot Panda is also a cyber threat group linked to China. Its main focus is on institutions in East and South-East Asia. Its activities are probably related to gathering information related to domestic security and corruption.

Cloudflare Blames Outage on React2Shell Patch

Cloudflare clearly stated in its blog and official statement after the December 5, 2025, outage: “This incident was caused by a config change made to prevent the React2Shell (CVE-2025-55182) vulnerability.”

In other words, React2Shell had a severe RCE (Remote Code Execution) vulnerability. Cloudflare applied a patch to its WAF (Web Application Firewall) to prevent this. But this patch was not compatible with their old proxy system, causing 500 errors and about 25 minutes of outage worldwide.

Cloudflare openly said that this was not a hack or attack from outside. There was a technical glitch while installing the security patch.

Zero-Click Attack on Perplexity’s Comet Browser

AI browsers are designed to make our work easier – but when that same automation turns into a threat, the damage can be unimaginable. Recently, cybersecurity researchers discovered a zero-click exploit in Perplexity’s Comet browser that can completely delete your Google Drive with just a single email.

This technique has been named: Google Drive Wiper, and its severity is such that the user doesn’t need to click anything – the browser acts automatically.

How does this attack work?

The Comet browser provides automated access to tools like Gmail and Google Drive. This means the user can give instructions in simple language, such as: “Handle this file.” “Take care of it.” But this very feature opens the door for cyber attackers. The LLM sometimes interprets such vague sentences as action commands and can delete or move files without confirmation.

So the hacker simply does this:

Sends emails containing malicious prompts,

The browser executes the instructions as soon as it reads the email,

Drive data can be deleted or modified,

The user remains unaware – until the data is gone.

Another Threat: Hashjack Attack. This technique works even more stealthily.

HashJack is a prompt injection attack in which the hacker inserts hidden commands inside a URL, after # (hash). This URL looks normal, but the part after the (#) may be a hidden prompt. AI-powered browsers (like Comet) read this hidden text as a prompt and can initiate actions accordingly.

Zero-Click Attack on Perplexity's Comet Browser

What does Hashjack do?

The hacker creates a URL containing hidden AI commands. As soon as the user opens the link, the prompt is injected into the browser. The AI ​​agent can execute file operations and Drive actions. The attack can be launched by sending the link anywhere – email, WhatsApp, X (Twitter), Facebook, etc. This is also a zero-click style client-side exploit. The user opens the link → The attack is executed.

Why is the threat significant for organizations?

Business documents, client files, research data, everything is stored on Drive. Zero-click exploits are difficult to detect. Due to the unpredictability of LLM, even a small prompt change can have a big impact. Attack automation can take down multiple accounts at once. AI browsers make things faster – but this same automation, if unchecked, can be disastrous.

How can you keep yourself safe?

Security experts recommend a four-layer protection approach:

AI browsers are the future – faster, hands-free, and smarter. But with automation comes the biggest questions:

Who has control? With the user or with the AI ​​agent?

The Comet Browser zero-click exploit is a reminder that AI is as powerful as it is risky. The next cyberwar will be fought not with a keyboard, but with prompts.

Crypto Clipper in the Supply Chain: The NPM Breach Every Developer Should Know About

A developer fell victim to a phishing email that allowed attackers to gain control of his account and insert malicious code into trusted packages. If you deal with crypto or use NPM, this could affect you, too.

In this blog, we’ll look at what the attacker did, the extent of the damage, how you can protect yourself, and what it means going forward. 

How the Breach Happened

Prominent NPM maintainer Josh Junan, also known as Kix, was hit by a phishing attack that reset two-factor authentication on his account. The attackers then injected malicious updates into at least 18 packages, including Chalk debug strips and styles, and others. These packages together have over 2 billion downloads each week, with some reports putting the number as high as 2.6 billion. 

The malware injected was a crypto clipper. It intercepts web3 or crypto transactions in the browser and silently changes wallet addresses, redirecting funds to an account controlled by the attacker without raising any significant alarm. Fortunately, this attack was quickly discovered by Iikido, a Belgian security company. 

Crypto Clipper in the Supply Chain The NPM Breach Every Developer Should Know About

How the Malware Works (Step by Step)

The phishing email

The developer himself reported that his account was hacked through phishing. He received an email from support[at]npmjs[dot]help, appearing to be from official support for npm (a popular package registry). However, it was actually a fake email, asking him to click on something or log in, which led to his account being stolen.

This means that someone posing as npm support tricked him—and this is the exact method of phishing.

Maintainer response

After Aikido notified the maintainer on Bluesky, he responded at 15:15 UTC that he had realized the package had been compromised and was now starting to clean it up.

He also stated that the phishing email came from support [at] npmjs [dot] help.

The good news is that he had deleted most of the compromised packages before losing access to his account. However, Simple-Swizzle is still compromised.

Even though only a few users were directly affected, this incident shows how fragile and far-reaching the trust in the supply chain can be. The rapid response minimized the damage. Many compromised versions were removed within an hour, but some cached lock files or indirect dependencies may still harbor malware, so be extra vigilant.

You can do this to protect yourself and your projects.

The Ledger CTO recommends caution with on-chain transactions. If you use a hardware wallet, double-check every destination address before approving. And finally, adopt supply chain defenses. Use tools that detect malicious package changes, monitor registry updates, and flag suspicious code. This attack is a stark reminder that there are real risks in the open-source ecosystem, even from trusted contributors.

This whole thing is a wake-up call for anyone relying on open-source. One fake email almost slipped malware into billions of downloads. Money lost this time? Not much. But next time, who knows? Your best bet: run regular audits, stay alert, and talk about these risks with your team. Pass the word along. Stay sharp.

Source: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised

GlassWorm Malware Returns – This Time Hijacking the Visual Studio Marketplace & OpenVSX

That old Glassworm supply chain attack is back, and now it’s in both the Microsoft Visual Studio Marketplace and OpenVSX.

It installed 24 fake extensions that are nearly perfect copies of the originals. I’m talking about official-looking extensions for popular apps like Flutter, React, Tailwind, Vim, and Vue. The name, the icon, the description, everything looks real, so developers might install them without thinking.

The sure thing is: they’re malware. They can infiltrate your system, tamper with your code, steal your data, or open backdoors for even worse things.

Glassworm Supply Chain Attack Returns Stronger Than Before

This Glassworm thing is no ordinary malware. It appeared in October 2025, and the more researchers looked at it, the more they realized how cunning and harmful it is.

Typically, malware uses a website or IP address for its command-and-control (C2) server, but this Glassworm uses the Solana blockchain! Yes, attackers are controlling the malware through messages hidden in blockchain transactions. This is bad news because the blockchain is everywhere – it’s nearly impossible to block or remove. This malware does more than just hack your system; it steals developer credentials for:

With these, attackers can break into your repositories, modify code, or spread even more malware. It’s not an exaggeration to say that this is a full-fledged criminal operation targeting developers to hijack their tools, code, crypto, and computers.

John Tuckner, a researcher at Secure Annex, discovered a new Glassworm attack. This time, they created 24 fake VS Code extensions and posted them to both the VS Code Marketplace and Open VSX.

Many developers use Flutter, Tailwind, Vim, YAML, Svelte, React Native, and Vue. Good extensions can make working with them much easier, faster, and more enjoyable.

Attackers know that developers are quick to find extensions for these tools. Therefore, they create extensions with names, icons, and descriptions that look exactly like the real thing.

How to Identify Fake Extensions Before Installing

There’s just one trick:

And inside the code of the fake extensions, they hide nasty things (like Glassworm). The extension will appear to be working, but it will secretly steal your credentials, code, crypto wallet, and everything else.

Why Organizations Are Turning to RPAM?

Cyberattacks keep getting smarter, so companies are turning to Remote Privileged Access Management, or RPAM, to lock down their most sensitive systems. Attackers usually go after privileged accounts, so it makes sense to put extra focus there. 

What is RPAM (Remote Privileged Access Management)?

RPAM (Remote Privileged Access Management) is a cybersecurity solution that allows organizations to secure, control, and monitor privileged access to their critical systems – especially when the access is remote.

In simple terms, it lets organizations decide exactly who gets into their critical systems, especially when people need to log in from outside the office.

Why Organizations Are Turning to RPAM

RPAM essentially does the following:

  1. First, it lets admins, IT folks, or outside vendors do their jobs remotely, but without ever seeing or handling actual passwords. No more risky password sharing or stashing sticky notes on monitors.
  2. RPAM hides those important credentials in a secure vault and hands out temporary access tokens when someone needs to get in. That way, people can do what they need to do, but never actually see the passwords themselves.
  3. Every privileged session gets recorded from start to finish. If anything looks off, or if there’s ever a question about what happened, you’ve got a full audit trail.
  4. It runs on strict zero-trust rules. Every session gets checked, monitored, and tightly controlled, even if it’s someone logging in from their living room.
  5. And RPAM tackles one of hackers’ favorite tricks: abusing admin accounts. By making it tough to steal or misuse high-level access, RPAM slams the door on a major entry point for attackers.

Where will You Find RPAM Working?

IT admins use it to manage servers from afar. Vendors need it when they connect to company systems. It’s key for handling cloud infrastructure, tweaking databases, or making changes to network settings. And if there’s an outage and you suddenly need emergency access, RPAM has your back.

Why is RPAM such a big deal? 

Seventy percent of cyberattacks go after privileged accounts. RPAM steps in early, blocking unauthorized access, keeping passwords safe, stopping remote hacks, and keeping insiders from poking around where they shouldn’t.

Privileged access management isn’t what it used to be. With remote work and the rise of the cloud, the old ways just don’t cut it anymore. RPAM cloud-native and made for the way we work now- gives you real control over who gets in, when, and from where.

These days, you even get features like AI-driven threat detection, which spots suspicious activity on the fly. Problems get caught before they snowball. Zero-trust isn’t just buzz; it means every access request gets double-checked, every time. No matter where your team logs in from, RPAM keeps privileged access locked down and helps you stay compliant.

ShadyPanda turns popular browser extension with 4.3 million installs into spyware

A hacker named “ShadyPanda” ran a browser extension for seven years. People installed it more than 4.3 million times, never realizing it was fake.

Koi Security, a security company, reported that five extensions were initially legitimate but were modified to contain malware in mid-2024. They were downloaded 300,000 times, but Google has now removed them all.

These extensions are now running dangerous code every hour – downloading and running new JavaScript from the browser without your knowledge, and exerting complete control. Security researcher Tuval Admoni explained that they track every website you visit, steal your entire browsing history (even if it’s encrypted!), and collect your browser’s complete ‘fingerprint’ – meaning all your device information.

And the worst part is that one of these extensions, Clean Master, was ‘verified’ and ‘featured’ by Google itself! Meaning, people had complete trust in it. Hackers exploited this trust to amass a large following, and then, years later, quietly added dangerous updates without anyone noticing.

ShadyPanda turns popular browser extension with 4.3 million installs into spyware

For seven years, this actor learned how to weaponize browser marketplaces – building trust, accumulating users, and striking through silent updates.

Phase 1: The Wallpaper Hustle (145 Extension)

ShadyPanda’s first major scam was carried out in 2023, a simple yet clever operation. It uploaded a total of 145 extensions to both the Chrome and Edge stores: 20 extensions on Chrome under the publisher name ‘nuggetsno15’, and 125 extensions on Edge under the name ‘rocket Zhang’. All were disguised as ‘wallpapers’ or ‘productivity tools’ as if nothing existed! In reality, they were all just committing affiliate fraud. 

What does it mean?

ShadyPanda learned three important lessons from this:

Phase 2: Search Hijacking Evolution

ShadyPanda grew even more emboldened. In early 2024, it went beyond simply making money and began directly controlling browsers.

The most prominent example of this was an extension called ‘Infinity V+’ which touted itself as a ‘new tab productivity tool,’ but was actually hijacking the browser itself!

How?

Phase 3: The Long Game

ShadyPanda used five extensions, three of which were installed in 2018-19. One of these was Clean Master, which was installed by over 200,000 people! Initially, everything was perfect, no glitches. They ran as good extensions for years, and Google even made them ‘Featured’ and ‘Verified’.

Their strategy was simple:

First, build trust → then increase users → and one day, hack everyone with a single update! In fact, even before the hack, they were quietly tracking which extensions were being installed, where, and how to better spread their ‘malware’. Meaning, they were building malware based on the data!

Then, in mid-2024, when the total number of installs had reached over 300,000, they pushed a stealth update. Chrome and Edge automatically installed it on all users’ devices under the guise of automatic updates – because the extensions were ‘verified’! And now all five extensions are running the same malware, without anyone knowing.”

Phase 4: The Spyware Empire (5 Extensions, 4M+ Users)

ShadyPanda’s biggest play wasn’t Clean Master! The same publisher that brought Clean Master to Edge Starlab Technology launched five more extensions for Microsoft Edge around 2023. These have a combined total of over 4 million (over 4 million!) installs!

Now the biggest problem here is that all five extensions are still live on the Microsoft Edge store! While some of the previously dangerous extensions were removed, this operation to monitor over 4 million users is still ongoing!

Two of these extensions are outright spyware. The most dangerous is WeTab (WeTab New Tab Page), which alone has been installed by over 3 million people! It bills itself as a ‘productivity tool,’ but in reality, it’s an advanced surveillance platform, meaning your every move online is being tracked, recorded, and possibly sold.

Seven Years of Exploitation

ShadyPanda appears to be a very sophisticated hacker gang, but their true methods are different. They’ve been exploiting the same vulnerability for seven years; browser extensions are only reviewed initially, not later.

This means:

Extensions are only checked when they’re first uploaded. No one monitors any updates after that.

ShadyPanda is exploiting this vulnerability. They initially committed fraud on a small scale, but they learned with each step, and now they’re running a fully professional operation. Their various campaigns have many similarities, such as code signing, backend servers, and obfuscation styles, meaning the same people, under different names, are playing the same game over and over again.

Now the most dangerous part:

The auto-update system, designed to keep us safe, has become their biggest weapon. Chrome and Edge were delivering malware to users through their trusted updates. No phishing, no fraud, no nothing.

Users simply watched the extension update… and one day, that same extension became a spy.

Once this extension gained control, ShadyPanda could:

This is the most dangerous threat in a company because:

The developer’s laptop gets infected, API keys are stolen, and access to SaaS and cloud logins is gained, meaning the entire network is gradually taken over.

Extensions are typically not blocked by security tools, and ShadyPanda sat comfortably in this “blind spot” for a year.

The real problem isn’t just with ShadyPanda. The problem is that this entire model essentially invites attackers to:

ShadyPanda has demonstrated that this method works. And now other attackers will copy this strategy.

ShadyPanda proved that marketplaces still review extensions the same way they did seven years ago: static analysis at submission, trust after approval, and no ongoing monitoring. Clean Master worked flawlessly for five years. Static analysis wouldn’t have revealed this.


Source: Koi Security research team