MalwarePublished 3 Dec 2025

4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign

Source AlienVault OTX General

Description

The ShadyPanda threat actor has conducted a sophisticated seven-year malware campaign infecting 4.3 million Chrome and Edge browsers via malicious extensions that were verified and featured by Google, enabling widespread trust and distribution. The campaign operates two main components: a 300,000-user remote code execution (RCE) backdoor and a 4-million-user spyware operation that harvests extensive user data such as browsing history, search queries, and mouse clicks, sending it to servers in China. This malware exploits vulnerabilities in browser extension marketplaces and trusted update mechanisms to maintain persistence and evade detection. The campaign highlights significant risks to user privacy and organizational security, especially for entities relying heavily on Chrome and Edge browsers. European organizations face risks of data exfiltration, espionage, and potential lateral movement within networks. Mitigation requires proactive extension management, network monitoring for suspicious domains, and enhanced user awareness. Countries with high Chrome/Edge usage and strategic geopolitical interest in China-related cyber espionage are most at risk. The threat severity is assessed as high due to the scale, stealth, and potential impact on confidentiality and integrity without requiring user interaction post-installation.

Impact

For European organizations, the ShadyPanda campaign presents a substantial risk to confidentiality and integrity of sensitive information. The spyware component can lead to large-scale data leakage including user behavior and potentially sensitive corporate browsing data. The RCE backdoor enables attackers to execute arbitrary code, potentially facilitating lateral movement, installation of additional malware, or espionage activities within corporate networks. Given the widespread use of Chrome and Edge browsers in Europe, especially in corporate environments, the risk of infection is significant. The campaign’s stealth and use of trusted extensions complicate detection and response efforts. Additionally, exfiltrated data being sent to servers in China raises concerns about geopolitical espionage targeting European entities. The campaign could disrupt operations if exploited for sabotage or ransomware deployment. Privacy regulations such as GDPR may also impose legal and financial consequences on organizations failing to protect user data from such breaches.

Defensive guidance

European organizations should implement strict browser extension policies, including whitelisting only vetted and necessary extensions and regularly auditing installed extensions for suspicious behavior. Employ endpoint detection and response (EDR) solutions capable of monitoring browser processes and network traffic for connections to known malicious domains such as cleanmasters.store and dergoodting.com. Network-level controls should block or monitor traffic to identified ShadyPanda infrastructure domains and IPs. User education campaigns must emphasize the risks of installing unverified extensions and encourage reporting of unusual browser behavior. Organizations should leverage browser security features such as extension permission reviews and disable automatic extension updates where feasible to prevent stealthy malicious updates. Incident response plans should include procedures for rapid identification and removal of malicious extensions and forensic analysis of affected systems. Collaboration with browser vendors to report and expedite removal of malicious extensions is critical. Finally, monitoring for indicators of compromise and threat intelligence sharing within European cybersecurity communities will enhance detection and mitigation efforts.

Summary

ShadyPanda is a threat actor responsible for a prolonged and large-scale malware campaign spanning seven years, targeting users of Chrome and Edge browsers through malicious extensions. These extensions were able to bypass typical security scrutiny by being featured and verified by Google, which granted them a high level of trust and facilitated massive distribution. The campaign consists of two active operations: a remote code execution (RCE) backdoor affecting approximately 300,000 users, allowing the attacker to execute arbitrary code within the browser context, and a spyware operation impacting around 4 million users that collects sensitive user data including browsing history, search queries, and mouse click data. This data is exfiltrated to command and control servers located in China. The malware leverages the trusted update mechanisms of browser extensions to maintain persistence and evade detection, evolving from initial affiliate fraud tactics to sophisticated browser control and long-term trust exploitation. The campaign exploits inherent weaknesses in browser marketplace security models, demonstrating how verified extensions can be weaponized to compromise millions of users globally. Indicators of compromise include multiple suspicious domains such as cleanmasters.store, dergoodting.com, and extensionplay.com, which serve as infrastructure for command and control or data exfiltration. The campaign employs various techniques mapped to MITRE ATT&CK tactics including credential access, command execution, persistence, defense evasion, and data exfiltration. Despite the lack of known public exploits, the scale and stealth of this campaign pose a significant threat to user privacy and organizational security.

Indicators of compromise

Domains 8

cleanmasters.store
dergoodting.com
extensionplay.com
yearnnewtab.com
api.cgatgpt.net
api.cleanmasters.store
api.extensionplay.com
nossl.dergoodting.com

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Dec 2025, 11:35 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

Domains 8

Community reviews

Related threats