Researchers have unraveled a malware campaign that really did play the long game. After seven years of behaving normally, a set of browser extensions installed on roughly 4.3 million Chrome and Edge users’ devices suddenly went rogue. Now they can track what you browse and run malicious code inside your browser.

Full article here: https://www.malwarebytes.com/blog/news/2025/12/sleeper-browser-extensions-woke-up-as-spyware-on-4-million-devices

David Bombal

Researchers discovered a sophisticated malware campaign where browser extensions remained dormant for 7 years before activating as spyware in mid-2024. Five extensions with 4.3 million combined installs on Chrome and Edge suddenly began tracking browsing activity and executing malicious code remotely. The extensions, including WeTab with 3 million Edge installs, earned verified status before pushing silent updates that transformed them into remote code execution frameworks. Google removed the malicious extensions from Chrome, but they remain available in the Edge store. Users should check their installed extensions and remove suspicious ones by searching for specific extension IDs in developer mode.

WARNING: 4.3 million devices infected with Browser Extension Malware