StegoAd Edge's extension campaign that hides code in icons and sources to steal credentials

Microsoft has brought down a malicious extension operation at Edge's store that deserves a careful reading because it blends advanced evasion techniques with a simple goal: to steal credentials and generate cost-effective advertising fraud. Under the name StegoAd, the campaign joined steganography - hide code inside apparently harmless files - with a well-maintained command and control infrastructure, and Microsoft attributes 119 extensions to a single active actor since at least 2021.

The most worrying thing is not just the amount, but the engineering behind the stealth. Extensions appeared to be legitimate tools - ad blockers, VPNs, video downloads, translators - and worked in the visible, winning reviews as the malicious code remained asleep until multiple evasion controls were performed. The operators inlaid JavaScript after the PNGs IEND marker, migrated to WebP and then to WOF2 sources using glyphs or metadata ranges, and in more sophisticated variants left the "load" out of the package and served it from C2 servers only to customers who exceeded fingerprint filters and User-Agent. This systemic use of steganography within icons and sources is rare and difficult to detect with static scanners.

The known impact includes the insertion of ads, the hijacking of affiliate commissions and search readdresses, but the recovered artifacts show a greater risk: a backdoor capable of running remote JavaScript, Google's credentials theft and second factor codes, the exfiltration of session hijacking cookies and WordPress's credentials readers. Microsoft detected that Google Analytics identifiers were used as covert telemetry, which offered the operator panels in "almost real time." The campaign also took advantage of Cloudflare Workers and GitHub Pages as a proxy and hosting layer for their beacons, and maintained several C2 domains with automatic failure.

It should be stressed that the maximum number of facilities reported, up to 2.6 million, is a theoretical roof; techniques such as day-delayed activation, server-side validation and random execution doors (for example, running only in 10% of customers) reduce the activation rate and complicate the accounting of real victims. Still, the potential exposure and persistence of the actor in multiple extensions and versions (including the migration of Manifest V2 to V3) speak of a mature and adaptable operation.

If you use Edge, the immediate thing is to contrast your extensions with the published indicators and take action: open up edge: / / extensions and compare the installed IDs; if you find a match, uninstall the extension, change sensitive account passwords (Google, WordPress, banking), review recent access activity and enable more robust authentication methods. Cleaning cookies and sessions, closing session in critical services and revoking tokens or active sessions can mitigate session theft. For instructions on security keys and authentication resistant to this type of exfiltration, Google's WebAuthn security key guide is a useful resource: https: / / support.google.com / accounts / answer / 6103523.

IT administrators should consider extension restriction policies, white list blocking, and regular extension permit audits in managed environments. It is also advisable to review the automatic update settings and apply integrity controls to detect changes to extension files or icons that should not contain executable code. Additional information on the extension ecosystem and how Manifest V3 evolves is available in the Chromium documentation: https: / / develop.chrome.com / docs / extensions / mv3 /.

Beyond the individual reaction, StegoAd highlights two strategic lessons: first, the risk of the extension supply chain, where compromised developers or fraudulent accounts can distribute malicious code very efficiently; and second, the need to combine static detection with dynamic signals and behavior analysis to discover threats using layers of ofuscation and conditional delivery. Microsoft published a technical report with indicators and recommendations that should be reviewed in detail for response teams and researchers: https: / / www.microsoft.com / security / blog /.

Finally, the attribution points to overlapping with previous campaigns such as GhostPoster and ShadyPanda and domains linked to DarkSpectre, suggesting that actors with access to resources and operational continuity are iterating on proven techniques. The practical lesson for any user is clear: be selective with extensions, limit permissions, use strong authentication (preferably security keys) and act quickly in the face of suspicion of commitment. The threat is not purely theoretical: it has been unnoticed for years and was only interrupted by a mass elimination; next time, the difference between detecting or suffering from the theft of credentials may be in simple but constant preventive measures.