GhostPoster, the threat hidden in malicious extensions for Firefox, Chrome and Edge with 840,000 installations

The malicious GhostPoster extensions They have been found in 840,000 installations in Firefox, Chrome and Edge, from where they carry out background activity to monitor their victims.

GhostPoster is a campaign that uses malicious extensions to monitor the activity of its victims and install a backdoor on their computers. To do this, use JavaScript code that hides effectively in the PNG image of the extension logo using the steganography technique.

In December, analysts at security firm KOI identified 17 malicious applications for Mozilla Firefox, that offered popular services such as translation, ad blockers or VPN, and that accumulated more than 50,000 downloads.

Following this research, the LayerX company has identified another set of 17 malicious extensions related to GhostPoster that are distributed on this occasion in the stores of Microsoft Edge y Google Chrome, accumulating more than 840,000 installations in the three browsers.

Within this GhostPoster campaign, LayerX researchers also cite a “more sophisticated and evasive” variant, which alone has accumulated more than 3,800 installations.

Behind GhostPoster is a malicious actor called Darkspectre, which has dedicated itself in recent years to distributing ‘malware’ in extensions for web browsers. And it has also done so through ShadyPanda and The Zoom Stealer which, despite each of them having their own techniques and objectives, shared infrastructure with GhostPoster.

According to LayerX, some extensions have been present in the official browser stores since 2020, a discovery in line with what KOI already pointed out about Darkspectre: that the campaigns of this threat actor, described as “the largest and most sophisticated”, have been developed in operations that have lasted for years.