Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.

A coordinated campaign of 18 malicious browser extensions infected 2.3 million users across Chrome and Edge. These extensions, including a color picker tool, appeared legitimate with verified badges and high install counts. The RedDirection campaign implemented sophisticated browser hijacking mechanisms, capturing users' browsing data and potentially redirecting them to malicious sites. The malware was introduced through version updates of previously clean extensions, exploiting the auto-update feature of browsers. The campaign demonstrates systemic failures in marketplace security, verification processes, and trust signals, turning productivity tools into surveillance malware. Users are advised to remove affected extensions and monitor their accounts for suspicious activity.

• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsMalware2026-10-22
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI CredentialsMalware2026-10-21
• LiteLLM supply chain compromiseCampaign2026-10-22
• AOMEI Backupper update servers hijacked to push malware: Check your PCMalware2026-10-19
• NEBULA: Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLLMalware2026-10-09