Browser Extensions

The article details the threat landscape of 'suspicious websites' that evade traditional phishing classifications but remain highly dangerous. These include fake online stores, dubious crypto exchanges, and fake browser extensions. Threat actors leverage newly registered domains, cheap TLDs, and poor infrastructure security (missing HTTP headers, lack of SPF/DMARC) to conduct financial fraud, data theft, and browser hijacking. Detection requires a multi-faceted approach analyzing domain age, IP reputation, and infrastructure configurations.

2026-05-137 minPalo Alto Networkshigh

Unit 42 identified 18 high-risk browser extensions masquerading as GenAI productivity tools that function as remote access Trojans, infostealers, and spyware. These extensions exploit browser permissions to intercept API keys, exfiltrate DOM content, establish persistent WebSocket C2 channels, and dynamically route traffic via malicious proxy configurations.