WaSteal Update: Infrastructure Pivoting Reveals 57 Additional Extensions, Campaign Now at 183 Total

The WaSteal campaign involves a large number of malicious Chrome extensions used for data exfiltration. Recent analysis revealed 57 additional extensions linked to the same operator and backend, bringing the total to 183 active extensions on the Chrome Web Store. These extensions share the same exfiltration behavior and remain live, posing ongoing risk to users who install them. The campaign is actively tracked and reported by threat intelligence sources, but no specific patch or remediation guidance is provided in the available data.

• malext.io/reports/WaSteal (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1tv3ysa/wasteal_update_infrastructure_pivoting_reveals_57/ (opens in a new tab)
• malext.io (opens in a new tab)

• Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkitCampaign2026-09-15
• Open directory exposes a full SonicWall SMA1000 credential-theft campaign: 250 targets, 5 domains fully replicatedCampaign2026-09-10
• Four Billion Requests: The DDoS Campaign That Followed Our Meta Abuse-Ad ReportingCampaign2026-09-09
• Million-dollar phishing campaign uses invisible Unicode characters to bypass email filtersCampaign2026-09-05
• Anatomy of a scam campaign, from the point of view of a link shortenerCampaign2026-09-01