Over 2.3 million users hit by Chrome and Edge extension malware
Researchers say 18 popular browser extensions silently tracked users, hijacked sessions, and sent data to attacker-controlled servers.
A stealthy browser hijacking campaign has infected over 2.3 million users through Chrome and Edge extensions that appeared safe and even displayed Google’s verified badge.
According to cybersecurity researchers at Koi Security, the campaign, dubbed RedDirection, involves 18 malicious extensions offering legitimate features like emoji keyboards and VPN tools, while secretly tracking users and backdooring their browsers.
One of the most popular extensions — a colour picker developed by ‘Geco’ — continues to be available on the Chrome and Edge stores with thousands of positive reviews.
While it works as intended, the extension also hijacks sessions, records browsing activity, and sends data to a remote server controlled by attackers.
What makes the campaign more insidious is how the malware was delivered. The extensions began as clean, valuable tools, but malicious code was quietly added during later updates.
Due to how Google and Microsoft handle automatic updates, most users receive spyware without taking action or clicking anything.
Koi Security’s Idan Dardikman describes the campaign as one of the largest documented. Users are advised to uninstall any affected extensions, clear browser data, and monitor accounts for unusual activity.
Despite the serious breach, Google and Microsoft have not responded publicly.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!