LayerX Reveals 40+ Malicious Browser Extensions

Akamai acquired LayerX. This previously published blog post reflects the product and feature names on the original date of publication.

LayerX has identified over 40 malicious browser extensions that are part of three distinct phishing campaigns.

The initial detection of this campaign was done by the DomainTools Intelligence (DTI) team, who identified a list of suspicious domains that were communicating with browser extensions masquerading as legitimate brands. However, while the research by DTI provided a list of malicious domains, it did not identify the full list of individual malicious extensions.

Building on DTI’s initial research, LayerX investigated the flagged URLs to unearth the actual Chrome extension metadata. By analyzing the associated extension pages, LayerX has been able to identify:

• Extension IDs
• Extension Names
• The publishers behind them
• Extension meta-data such as publication date, last software update, etc.

This investigation revealed 40+ malicious extensions, many of which are still live on the Google Chrome Store.

The full list of extensions is provided at the bottom of this post.

The malicious extension pages exhibited a highly similar structure, formatting, and language, pointing to the likelihood that they were auto-generated using AI tools. This tactic enabled threat actors to rapidly scale their efforts across dozens of fake tools with minimal manual effort.

The extensions were carefully crafted to mimic well-known platforms, including:

• Fortinet / FortiVPN
• DeepSeek AI
• Calendly
• YouTube helper tools
• Crypto utilities like DeBank

By riding on the trust of established names, these malicious tools effectively bypassed user suspicion and evaded scrutiny during installation.

It’s not just that they tried to masquerade as known legitimate extensions and/or brands, they tried to make themselves lookalike:

• Registered domain names that looked similar (e.g., calendlydaily[.]world and calendly-director[.com], to impersonate Calendly)
• For all extensions part of this campaign, the publisher and email contact domain were not a private Gmail account, but an independent domain, to make it appear more credible
• The contact email addresses followed a standard format of “support@domain-name”, again giving more credibility and making it appear as if there is a legitimate publisher behind it

These extensions grant attackers persistent access to user sessions, allowing for data theft, impersonation, and potential entry into corporate environments.

Organizations can manually block malicious extensions through MDM or browser policy enforcement. However, this method is often labor-intensive, requiring security teams to track extension IDs, monitor new threats, and respond in near real-time.

Adopt basic hygiene policies for browser extensions:

• Block extensions from unknown or unverified publishers
• Restrict the installation of young extensions (recently published)
• Flag extensions with low review count or unusual permission requests
• Avoid tools associated with suspicious or brand-spoofing domains

While some compromised extensions have already been removed from the Google Chrome Store, removal from the store does not remove active installations from users’ browsers. Therefore, users and organizations must manually go in and remove them.

For organizations concerned about their browser extension threat surface, LayerX is offering a free browser extension audit. The audit includes discovery of all browser extensions installed in your environment, mapping which users have what extensions installed and actionable recommendations to remediate exposure to malicious extensions.

Click here to sign up for the complementary extension audit.