A hacker named “ShadyPanda” ran a browser extension for seven years. People installed it more than 4.3 million times, never realizing it was fake.
Koi Security, a security company, reported that five extensions were initially legitimate but were modified to contain malware in mid-2024. They were downloaded 300,000 times, but Google has now removed them all.
These extensions are now running dangerous code every hour – downloading and running new JavaScript from the browser without your knowledge, and exerting complete control. Security researcher Tuval Admoni explained that they track every website you visit, steal your entire browsing history (even if it’s encrypted!), and collect your browser’s complete ‘fingerprint’ – meaning all your device information.
And the worst part is that one of these extensions, Clean Master, was ‘verified’ and ‘featured’ by Google itself! Meaning, people had complete trust in it. Hackers exploited this trust to amass a large following, and then, years later, quietly added dangerous updates without anyone noticing.
For seven years, this actor learned how to weaponize browser marketplaces – building trust, accumulating users, and striking through silent updates.
Phase 1: The Wallpaper Hustle (145 Extension)
ShadyPanda’s first major scam was carried out in 2023, a simple yet clever operation. It uploaded a total of 145 extensions to both the Chrome and Edge stores: 20 extensions on Chrome under the publisher name ‘nuggetsno15’, and 125 extensions on Edge under the name ‘rocket Zhang’. All were disguised as ‘wallpapers’ or ‘productivity tools’ as if nothing existed! In reality, they were all just committing affiliate fraud.
What does it mean?
- As soon as a user visited a site like eBay, Amazon, or Booking.com, these extensions would silently insert their tracking code.
- Then, if the user made a purchase, ShadyPanda would receive a commission without the user knowing! At the same time, they were tracking and selling all your browsing information, every website, every search, every click through Google Analytics. The scheme wasn’t very complex, but it was successful.
ShadyPanda learned three important lessons from this:
- Chrome’s review only looks at the initial results – it doesn’t check what the extension is doing later.
- People blindly trust extensions with high downloads and good reviews.
- Being slow can cause more harm – many extensions run for months without anyone even noticing!
Phase 2: Search Hijacking Evolution
ShadyPanda grew even more emboldened. In early 2024, it went beyond simply making money and began directly controlling browsers.
The most prominent example of this was an extension called ‘Infinity V+’ which touted itself as a ‘new tab productivity tool,’ but was actually hijacking the browser itself!
How?
- As soon as you searched for anything, it redirected you to a well-known hijacking site called trovi.com.
- Your search queries were recorded, sold for money, and search results were manipulated to benefit ShadyPanda.
- Furthermore, the extension stole your cookies (such as those from Amazon, Gmail, etc.) and sent them to a server called nossl.dergoodting.com.
- This created a unique ‘tracking ID’ for you, allowing you to monitor your every move online, all without your knowledge or permission!
Phase 3: The Long Game
ShadyPanda used five extensions, three of which were installed in 2018-19. One of these was Clean Master, which was installed by over 200,000 people! Initially, everything was perfect, no glitches. They ran as good extensions for years, and Google even made them ‘Featured’ and ‘Verified’.
Their strategy was simple:
First, build trust → then increase users → and one day, hack everyone with a single update! In fact, even before the hack, they were quietly tracking which extensions were being installed, where, and how to better spread their ‘malware’. Meaning, they were building malware based on the data!
Then, in mid-2024, when the total number of installs had reached over 300,000, they pushed a stealth update. Chrome and Edge automatically installed it on all users’ devices under the guise of automatic updates – because the extensions were ‘verified’! And now all five extensions are running the same malware, without anyone knowing.”
Phase 4: The Spyware Empire (5 Extensions, 4M+ Users)
ShadyPanda’s biggest play wasn’t Clean Master! The same publisher that brought Clean Master to Edge Starlab Technology launched five more extensions for Microsoft Edge around 2023. These have a combined total of over 4 million (over 4 million!) installs!
Now the biggest problem here is that all five extensions are still live on the Microsoft Edge store! While some of the previously dangerous extensions were removed, this operation to monitor over 4 million users is still ongoing!
Two of these extensions are outright spyware. The most dangerous is WeTab (WeTab New Tab Page), which alone has been installed by over 3 million people! It bills itself as a ‘productivity tool,’ but in reality, it’s an advanced surveillance platform, meaning your every move online is being tracked, recorded, and possibly sold.
Seven Years of Exploitation
ShadyPanda appears to be a very sophisticated hacker gang, but their true methods are different. They’ve been exploiting the same vulnerability for seven years; browser extensions are only reviewed initially, not later.
This means:
Extensions are only checked when they’re first uploaded. No one monitors any updates after that.
ShadyPanda is exploiting this vulnerability. They initially committed fraud on a small scale, but they learned with each step, and now they’re running a fully professional operation. Their various campaigns have many similarities, such as code signing, backend servers, and obfuscation styles, meaning the same people, under different names, are playing the same game over and over again.
Now the most dangerous part:
The auto-update system, designed to keep us safe, has become their biggest weapon. Chrome and Edge were delivering malware to users through their trusted updates. No phishing, no fraud, no nothing.
Users simply watched the extension update… and one day, that same extension became a spy.
Once this extension gained control, ShadyPanda could:
- See your browser logins
- Hijack your sessions
- Take over your account
- Or hack your company’s developers.
This is the most dangerous threat in a company because:
The developer’s laptop gets infected, API keys are stolen, and access to SaaS and cloud logins is gained, meaning the entire network is gradually taken over.
Extensions are typically not blocked by security tools, and ShadyPanda sat comfortably in this “blind spot” for a year.
The real problem isn’t just with ShadyPanda. The problem is that this entire model essentially invites attackers to:
- First, create a good extension
- Gain trust by passing reviews (installs, reviews, verified badges, etc.)
- People start using it
- Then secretly insert malware in updates
- Making money while remaining undetected
ShadyPanda has demonstrated that this method works. And now other attackers will copy this strategy.
ShadyPanda proved that marketplaces still review extensions the same way they did seven years ago: static analysis at submission, trust after approval, and no ongoing monitoring. Clean Master worked flawlessly for five years. Static analysis wouldn’t have revealed this.
Source: Koi Security research team