1 of 1
Story summary
- The threat actor ShadyPanda infected over 4.3 million Google Chrome and Microsoft Edge users via five browser extensions, including Clean Master and WeTab, which later delivered malicious updates enabling remote code execution and data exfiltration.
- Koi researchers say these extensions monitor user activity and send data to ShadyPanda-controlled servers.
- Users should uninstall the affected extensions and change credentials because the malware remains active on infected browsers even after marketplace removals.
