Millions of users were unknowingly tracked in a 7‑year Chrome and Edge malware scheme — extensions turned into spyware

by

Like what you’re reading? To stay informed about the newest Windows news, reviews, and features, consider adding Windows Central as a preferred source in Google Search. You can learn more about the benefits of doing so on our site.

According to TheRegister, a user named ShadyPanda started publishing seemingly harmless browser extensions in 2018. For seven years, these extensions worked as expected, gaining the trust of many users. Once millions of people had installed them, the extensions were secretly updated to spy on users. Koi Security discovered this activity while monitoring how the extensions behaved and detailed their findings in a report.

These browser extensions were marketed as tools to help people be more productive, and several were officially highlighted and approved by Chrome and Edge. Over 4.3 million users across both browsers were impacted. A popular example, Clean Master, had been installed over 200,000 times.

WeTab, a browser extension, and other extensions from the same creator have been installed over 3 million times on Edge and Chrome browsers.

The threat is now removed, but users should still review their browsers

The harmful update let the extensions secretly gather a lot of information about your browsing. This included every website you visited, your complete browsing history, and anything you searched for. They also recorded your mouse clicks, collected details about your browser setup, and tracked your movement between websites.

Google and Microsoft have both confirmed they’ve removed harmful extensions from their online stores – the Chrome Web Store and the Edge add-on store, respectively. But simply removing them from the stores doesn’t automatically remove them from your computer, so it’s important for users to check which extensions are currently installed on their browsers.

If you use Chrome or Edge, check your extensions for anything created by Starlab Technology or connected to WeTab. It’s also a good idea to get rid of any extensions you don’t recognize or no longer need.

Make sure to update your Chrome or Edge browser regularly. Updates include important security improvements that monitor extensions and block any that are harmful or outdated. They also ensure you’re using the latest version and not an older, potentially vulnerable one.

This malware saves unique IDs in your Chrome browser’s sync settings. These IDs can move with you to different devices, meaning your browsing activity could still be tracked even if you reinstall the browser. To completely get rid of these trackers, you should delete your synced data after removing any problematic extensions.

Read More

2025-12-07 18:39