ShadyPanda Turns Popular Browser Extensions with 4.3 Million Installs Into Spyware
ShadyPanda Turns Popular Browser Extensions with 4.3 Million Installs Into Spyware
01 December 2025
A threat actor known as ShadyPanda has been linked to a seven-year-long browser extension campaign that has amassed over 4.3 million installations over time.
Five of these extensions started off as legitimate programs before malicious changes were introduced in mid-2024, according to a report from Koi Security, attracting 300,000 installs. These extensions have since been taken down.
"These