When Productivity Extensions Become Attack Platforms

Browser extensions have become one of the most effective ways for threat actors to gain persistent access to users’ browsing activity. Unlike traditional malware, malicious extensions inherit users’ trust, execute inside the browser, and often require only a single installation to remain active indefinitely.

During ongoing threat hunting across the Chrome Web Store and Microsoft Edge Add-ons Store, LayerX Research (now part of Akamai) identified a coordinated browser extension campaign consisting of 32 malicious extensions that collectively affected more than 6,150 users.

At first glance, the extensions appear unrelated. They present themselves as productivity tools including text utilities, YouTube enhancements, SEO helpers, note-taking applications, language assistants, markdown utilities, and other browser conveniences. Each uses different branding and advertises different functionality.

Beneath this superficial diversity, however, most of the extensions share nearly identical infrastructure, suggesting they originate from a common development framework. Additionally, all the extensions share Korean localization resources, Korean-language comments, and other development artifacts. 

These common characteristics strengthen our assessment that the extensions are part of the same campaign and were developed by the same threat actor, whether an organized group or an individual.

The earliest extensions associated with this campaign appeared in March 2025, with additional extensions continuing to be published throughout the following months.

Rather than republishing the same extension, the operators continuously introduced new variants built on the same underlying framework.

LayerX researchers identified:

• 32 malicious browser extensions

• Distributed through:

  • Google Chrome Web Store

  • Microsoft Edge Add-ons Store

• More than 6,150 affected users

The extensions masquerade as unrelated utilities, including:

• Text counters

• Markdown utilities

• YouTube enhancements

• Video speed controllers

• SEO tools

• Language assistants

• Note-taking tools

• Scroll utilities

• AI-related helpers

Although the extensions appear unrelated, static analysis revealed that most of them reuse nearly identical background service workers, telemetry logic, storage structures, and navigation handling. Aside from branding assets and their advertised functionality, the underlying implementation remains largely unchanged, strongly suggesting the extensions were generated from a common development framework.

None of the individual extensions appears particularly remarkable when viewed in isolation. Each advertises a plausible productivity feature, uses its own branding, and has a relatively small user base. Only by correlating publisher information, code similarity, shared remote infrastructure, and runtime behavior does the broader campaign become apparent. 

Figure 1 illustrates how modern browser extension campaigns can remain hidden in plain sight by distributing malicious functionality across numerous seemingly unrelated extensions.

Rather than embedding operational logic inside the extension package, most of the extensions retrieve a remote configuration file from the same jsDelivr-hosted endpoint (Figure 2)

Once downloaded, the configuration is parsed and cached locally:

Using a remote configuration significantly increases the flexibility of the campaign. Instead of publishing a new extension version through the Chrome Web Store or Microsoft Edge Add-ons Store, the operators can simply modify the configuration file to change the extension’s behavior. This allows them to immediately update targeted websites, redirect destinations, or campaign logic without triggering another browser store review.

During our investigation we observed the remote configuration change multiple times. At one point, the configuration was completely empty, suggesting the infrastructure was temporarily disabled or reset (Figure 3).

Several days later, it contained rules for affiliate traffic redirection. This demonstrates that the campaign’s behavior is actively managed through the remote configuration rather than being statically embedded inside the extensions (Figure 4).

The downloaded configuration does not contain plaintext values. Instead, hostnames, redirect payloads, and internal identifiers are Base64 encoded and reconstructed at runtime (Figure 5).

Base64 encoding provides no cryptographic protection and offers no functional benefit for the extension itself. Instead, it raises the effort required for manual inspection and automated static analysis by concealing targeted domains and redirecting payloads until runtime.

The decoded values are then used to reconstruct the navigation rules applied throughout the remainder of the extension’s execution.

After initialization, the background service worker continuously monitors users’ browsing activity using the webNavigation API (Figure 6).

Because every completed navigation is processed, the extension effectively observes a user’s browsing session regardless of whether the visited website is related to the extension’s advertised functionality (Figure 7).

Once a hostname matches one of the remotely supplied rules, the extension invokes chrome.tabs.update() to silently replace the active tab.

Unlike hard-coded redirect campaigns, the destination URL is reconstructed dynamically from the downloaded configuration rather than being embedded inside the extension.

Because redirect destinations are supplied remotely rather than embedded in the extension, the operators can change campaign targets at any time without publishing a new browser store update.

https://cdn.jsdelivr.net/gh/chosanghyeon-dev/chosanghyeon-dev@main/cf.json

https://link.coupang.com/a/dUnRI6

https://link.coupang.com/a/ej6z6U

api.pvmf.workers.dev

indie05hacker@gmail.com