Akamai
Skip to main content
Akamai
Log in
Log in Close
Cloud Manager
Manage your cloud computing services
Log in Close
Control Center
Manage your security and delivery services
Background

Browser Extensions Gone Rogue: The Full Scope of the GhostPoster Campaign

January 15, 2025 by Natalie Zagarov

Share

Akamai acquired LayerX. This previously published blog post reflects the product and feature names on the original date of publication.

Last month, researchers at Koi Security published a detailed analysis of a malicious Firefox extension they dubbed GhostPoster – a browser-based malware leveraging an uncommon and stealthy payload delivery method: steganography within a PNG icon file. This innovative approach allowed the malware to evade traditional extension security reviews and static analysis tools.

Following their publication, our investigation identified 17 additional extensions associated with the same infrastructure and tactics, techniques, and procedures (TTPs). Collectively, these extensions were downloaded over 840,000 times, with some remaining active in the wild for up to five years.

Technical Overview: Multi-Stage Evasion and Payload Delivery

The GhostPoster malware employs a multi-stage infection chain designed for stealth and persistence:

  1. Payload Encoding: The initial loader is embedded within the binary data of an extension’s PNG icon.
  2. Runtime Extraction: Upon installation, the extension parses the icon to extract the hidden data, a behavior that deviates from typical extension logic.
  3. Delayed Activation: The malware delays execution by 48 hours or more, and only initiates C2 communication under specific conditions.
  4. Payload Retrieval: The extracted loader contacts a remote C2 server to download additional JavaScript-based payloads.

Post-activation, the malware is capable of:

  • Stripping and injecting HTTP headers to weaken web security policies (e.g., CSP, HSTS).
  • Hijacking affiliate traffic for monetization.
  • Injecting iframes and scripts for click fraud and user tracking.
  • Programmatic CAPTCHA solving and injection of additional malicious scripts for extended control.

These features indicate the campaign is not only financially motivated but also technically mature, emphasizing operational stealth and longevity.

Infrastructure and Threat Attribution

The infrastructure uncovered by Koi Security was linked to 17 Firefox extensions, all sharing similar obfuscation patterns, C2 behavior, and delayed execution strategies. Our automated Extension malware lab feature confirmed the same threat actor infrastructure was also used to distribute extensions on the Google Chrome and Microsoft Edge Add-ons Store. Our analysis shows the campaign originated on the Microsoft Edge browser, with later expansion to Firefox and Chrome.

GhostPoster Upload
Figure 1. GhostPoster Upload to Browser Extension Stores
GhostPoster Upload

Key findings:

  • 17 confirmed extensions, with infrastructure overlap and common loader patterns.
  • Over an additional 840,000 cumulative installs across Firefox, Chrome and Edge browsers.
  • Malicious presence dating back to 2020, indicating long-term operational success, bypassing all major browsers stores’ security checks .
  • Variants using alternate delivery mechanisms, suggesting ongoing experimentation and adaptation.

Extended Variant Analysis: Background Script–Based Payload Staging

Beyond the previously identified extensions, we observed a more sophisticated and evasive variant associated with the same campaign, which alone accounted for 3,822 installs. 

Firefox Extension
Figure 2. Firefox Extension Available for Download in Store.
Firefox Extension

In this iteration, the malicious logic is embedded within the background script and leverages an image file bundled inside the extension as a covert payload container. At runtime, the background script fetches the image and scans its raw byte sequence for the delimiter [62,62,62,62] – corresponding to the ASCII string ‘>>>>’. All data following this marker is decoded as text and stored persistently in chrome.storage.local under the key instlogo.

Reading .png Content
Figure 3. Reading .png Content, Decoding and Saving in Local Storage.
Reading .png Content

The stored data is later retrieved, Base64-decoded, and dynamically executed as an additional JavaScript payload.

Decoded .png
Figure 4. Decoded .png Payload.
Decoded .png

This secondary script introduces further evasion by sleeping for approximately five days before initiating network activity. Upon activation, it fetches content from a remote server, extracts server-supplied data stored as Base64-encoded keys, and executes the decoded content, enabling ongoing payload updates and extended control. 

Png Payload
Figure 5. Png Payload – Reading from Local Storage and Decoding the Next Stage.
Png Payload

This staged execution flow demonstrates a clear evolution toward longer dormancy, modularity, and resilience against both static and behavioral detection mechanisms.

Post-Takedown Persistence

While Mozilla and Microsoft have removed the known malicious extensions from their respective stores, extensions already installed on user systems remain active unless explicitly removed by the user. This persistence underscores the limitations of store takedowns as a containment strategy, particularly for malware employing delayed activation and modular payload delivery.

IOCs

 

IDNameInstalls
maiackahflfnegibhinjhpbgeoldeklbPage Screenshot Clipper86
kjkhljbbodkfgbfnhjfdchkjacdhmeaf

Full Page Screenshot

2,000
ielbkcjohpgmjhoiadncabphkglejgih

Convert Everything

17,171
obocpangfamkffjllmcfnieeoacoheda

Translate Selected Text with Google

159,645
dhnibdhcanplpdkcljgmfhbipehkgdkk

Youtube Download

11,458
gmciomcaholgmklbfangdjkneihfkdddRSS Feed2,781
fbobegkkdmmcnmoplkgdmfhdlkjfelnbAds Block Ultimate48,078
onlofoccaenllpjmalbnilfacjmcfhfkAdBlocker10,155
bmmchpeggdipgcobjbkcjiifgjdaodngColor Enhancer712
knoibjinlbaolannjalfdjiloaadnknjFloating Player – PiP Mode40,824
jihipmfmicjjpbpmoceapfjmigmemfamOne Key Translate10,785
ajbkmeegjnmaggkhmibgckapjkohajimCool Cursor2,254
fcoongackakfdmiincikmjgkedcgjkdp

Google Translate in Right Click

522,398
fmchencccolmmgjmaahfhpglemdcjfll

Translate Selected Text with Right Click

283
amazon-price-history

Amazon Price History

1,197

save-image-to-pinterest

Save Image to Pinterest on Right Click

6,517

instagram-downloading

Instagram Downloader3,807

TTPs

 

TacticTechnique
Defense EvasionLX7.011 (T1036) – Masquerading
Defense EvasionLX7.003 (T1140) – Code Obfuscation/Deobfuscation
Defense EvasionLX7.004 (T1678) – Delay Execution
Defense EvasionLX7.005 – Evade server-side checks
DiscoveryLX9.005 (T1217) – Browser Information Discovery

Recommendations

Security professionals, enterprise defenders, and browser developers should take the following actions:

  • Audit extensions within managed environments, especially those installed outside of policy controls.
  • Deploy behavior-based extension monitoring technologies to detect unauthorized network activity or suspicious DOM manipulation.

About the Author(s)

Natalie Zargarov

Natalie Zagarov

Natalie Zargarov is a Security Researcher with more than 10 years of experience in cybersecurity as a malware reverser and cyber intelligence researcher.

See Author bio

Tags

Security Research

Related Blogs

Akamai App & API Protector customers are protected.
Akamai App & API Protector customers are protected.
Security Research

CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products

October 07, 2026Akamai Security Intelligence Group

Read about CVE-2026-21589, a critical arbitrary file read vulnerability affecting multiple Atlassian Data Center products. Akamai customers are protected.

Read more
ExAR helped the customer contain the incident before it developed into a broader operational security event.
ExAR helped the customer contain the incident before it developed into a broader operational security event.
Security Research

How Akamai ExAR Contained a LATAM Supply Chain Attack

October 06, 2026Dennis Birchard and João Dejavite

Learn how Akamai ExAR helped contain a complex supply chain intrusion targeting Linux, OpenShift, and Windows DMZ workloads in Latin America.

Read more
These findings suggest an active ecosystem capable of supporting multiple monetization and attack strategies simultaneously.
These findings suggest an active ecosystem capable of supporting multiple monetization and attack strategies simultaneously.
Research

When Productivity Extensions Become Attack Platforms

September 30, 2026Natalie Zagarov

Our research uncovered a campaign of 32 malicious browser extensions that uses remote configs to spy on 9,800+ users and hijack browsing activity.

Read more