ShadyPanda Unmasked: 4.3 Million Chrome & Edge Users Compromised in a 7-Year Extension Supply-Chain Attack

A newly released investigation has exposed ShadyPanda, a highly advanced threat actor responsible for a sprawling seven-year browser supply-chain campaign that silently compromised 4.3 million Chrome and Microsoft Edge users worldwide.

By weaponizing trust in “Featured” and “Verified” browser extensions, ShadyPanda infiltrated enterprise environments and personal devices with a level of persistence and stealth rarely seen outside nation-state operations.

Unlike traditional malware campaigns, ShadyPanda didn’t rush.
They waited years — building credibility, amassing large user bases, and earning high marketplace trust scores — before delivering silent, malicious updates that opened the door to RCE backdoors, full-scale spyware, and browser-wide surveillance systems.

🕵️ How the Operation Worked: Trust First, Exploitation Later

ShadyPanda’s most infamous extension, Clean Master, operated as a legitimate browser utility for years, eventually accumulating over 300,000 users.

Then, in mid-2024, ShadyPanda flipped the switch.

A silent update transformed the extension into an hourly remote-code-execution launcher.
Every infected browser would:

⚡ Ping a command-and-control server every hour
⚡ Pull down arbitrary JavaScript payloads
⚡ Execute them with full browser privileges

This gave ShadyPanda the ability to pivot instantly across payloads:

• Surveillance

• Credential theft

• Session hijacking

• Real-time data exfiltration

• Even ransomware delivery

All of this without triggering static analysis, because the malicious payloads were never present in the extension code itself — only fetched at runtime.

🧪 Phase 4: Industrial-Scale Surveillance Through Microsoft Edge

While Chrome eventually removed these extensions, Microsoft Edge users were hit even harder.

Five active extensions — including the enormously popular WeTab — remain live in the Edge Marketplace, actively harvesting sensitive data from over 4 million users.

These extensions collect:

• Full URL history

• Search queries

• Real-time keystrokes

• Mouse movements (pixel-level tracking)

• Scroll behavior

• Storage contents (localStorage, sessionStorage)

• Persistent UUID4 user identifiers

• Browser cookies

• Full device fingerprints

All exfiltrated to servers located in China, including Baidu infrastructure and private C2 networks.

This effectively turns browsers into real-time surveillance devices, capable of profiling user behavior at unprecedented depth.

📤 Data Exfiltration Breakdown (Based on Koi Security Analysis)

Below is a condensed summary of the data categories harvested by ShadyPanda across multiple campaign phases:

🔹 Browsing Activity

• Every visited URL

• Referrer chains

• Navigation timestamps

🔹 User Input & Search

• Search queries (Google, Bing, etc.)

• Typing patterns + corrections

• Keystrokes before “Enter” is pressed

🔹 Device Fingerprinting

• OS, platform, language

• Screen resolution

• Timezone

• User-agent

🔹 Behavioral Biometrics

• X/Y mouse click coordinates

• Scroll depth

• Engagement time

🔹 Identity & Storage

• Persistent UUID4 identifiers

• Local/session storage contents

• Browser cookies (session hijacking risk)

This level of behavioral telemetry is typically reserved for state-sponsored intelligence collection — not browser extensions.

⚠️ The Real Problem: Trusted Extensions Aren’t Actually Safe

ShadyPanda exposed a fundamental flaw in browser extension security:

Trust Is Static — Code Is Dynamic

Chrome and Edge rely heavily on initial code reviews.
But extensions can:

✔ Pass inspection
✔ Build trust badges
✔ Earn 5-star reviews
✔ Accumulate millions of users

…and then push a malicious update later.

This is exactly how ShadyPanda delivered their payloads directly behind enterprise firewalls, using browser auto-updates as the infection mechanism.

The very feature designed to protect users ended up facilitating mass compromise.

🛡️ Elliptic Systems Recommendations

Organizations must reassess how browser extensions are managed:

1️⃣ Disable auto-installation of extensions across Chrome and Edge

Use enterprise policies to whitelist only essential, vetted extensions.

2️⃣ Block extension-based update channels for non-approved tools

Prevent dynamic code fetches and enforce least-privilege policies.

3️⃣ Monitor outbound connections to suspicious C2 infrastructure

Especially domains like:
api.extensionplay[.]com

4️⃣ Review browser storage for unauthorized extensions

Look for persistent UUIDs, unknown localStorage keys, and unusual cookies.

5️⃣ Educate users

Browser extensions are software.
Software is an attack surface.
Treat them accordingly.

🧭 Final Takeaway

ShadyPanda didn’t rely on zero-days or brute force.
They weaponized trust, patience, and the inherent weaknesses in browser extension ecosystems.

4.3 million users — including enterprise employees, developers, executives, and everyday consumers — were compromised not through hacking, but through blind trust in browser marketplaces.

This campaign is a stark reminder:
In modern cybersecurity, the threat isn’t always outside your browser — sometimes it’s installed inside it.