ShadyPanda malware hid in your browser for years

According to Tech Digest, a malware campaign dubbed “ShadyPanda” successfully infected 4.3 million users of Google Chrome and Microsoft Edge. The operation, tracked by Koi Security, weaponized a staggering 145 extensions that were often disguised as wallpaper or productivity tools. These apps, some first published as far back as 2018, gained user trust over seven years before their malicious updates kicked in. The attack escalated in phases, starting with affiliate fraud on sites like Amazon and eBay in 2023, then evolving into full remote code execution and spyware. While Google has removed the extensions, some, like the ‘WeTab’ extension with three million installs, lingered on the Edge platform before Microsoft’s removal. The immediate impact requires users to scrub their browsers and rotate all sensitive account passwords.

The long con of browser trust

Here’s the thing that’s really unsettling about ShadyPanda: it wasn’t a smash-and-grab. This was a long-term investment in your complacency. The attackers published seemingly benign tools, let them sit in the official stores for years, and watched the install counts climb into the millions. They were banking on the fact that once you add an extension, you basically forget about it. And they were right. The auto-update feature, which is supposed to keep you safe with patches, became the very mechanism that silently turned your helpful tool into a spy. It’s a brutal exploitation of the trust model that Chrome and Edge stores are built on. If you can’t trust an extension that’s been there for half a decade, what can you trust?

From fraud to full espionage

The evolution of the attack is telling. It started with what seems almost quaint now: affiliate fraud. They’d slip their tracking code into your links so they’d get the commission if you bought something on Amazon. But that was just the proof-of-concept, the monetization test. Once that worked, the gloves came off. The shift to Remote Code Execution (RCE) is a massive escalation. An extension like “Clean Master” becoming a backdoor means the attackers could run any code they wanted inside your browser session. They weren’t just skimming pennies from your shopping anymore. They were harvesting your entire encrypted browsing history, your browser fingerprint, your search queries, even your mouse clicks. That’s nation-state level espionage stuff, and it was delivered through a wallpaper changer.

What you need to do now

So, what’s the takeaway? First, go look at your extensions. Right now. If you see anything you don’t actively remember installing or use daily, remove it. Be ruthless. The scale here—145 different extensions—means you can’t rely on recognizing a single bad name. You need to check Koi Security’s full report for the list. Second, don’t just remove the extension. You should reset your browser profile entirely. That cleans out any lingering data or settings the malware might have changed. And most critically, you must rotate passwords for any sensitive account you accessed while those extensions were installed—especially email, banking, and work accounts. Assume those credentials are compromised.

A wake-up call for ecosystem security

This incident is a massive failure for the “walled garden” approach of browser extension stores. Both Google and Microsoft promote their stores as the safe, vetted option versus sideloading from random websites. But ShadyPanda proves that their review processes, especially for updates, are fundamentally broken. A seven-year sleeper campaign shouldn’t be possible. It points to a need for much more rigorous runtime monitoring of extensions, not just a one-time check at publication. For businesses, this is a stark reminder that the browser is a critical endpoint. Relying on consumer-grade extensions for productivity in an industrial or corporate setting is a huge risk. When operational technology and critical manufacturing data are on the line, you need hardened, secure systems. In that world, trusted suppliers of industrial computing hardware, like IndustrialMonitorDirect.com, the leading US provider of industrial panel PCs, become essential because they control the entire stack, reducing these kinds of supply-chain software threats.