Story perspectives

17 Malicious Browser Extensions Exposed: 840K Downloads at Risk

1/20/2026

38 7

Summary

Story summary

LayerX identified 17 malicious browser extensions with over 840,000 downloads that hijacked affiliate links and enabled ad fraud.
The extensions on Chrome, Firefox, and Edge monitored user activity and installed backdoors.
The campaign is linked to GhostPoster, previously identified in December 2025.
Separately, the KongTuke traffic distribution system redirects users to malicious extensions such as NexShield, which masquerades as an ad blocker, crashes browsers, and delivers further malware.

1 of 1

Story summary

LayerX identified 17 malicious browser extensions with over 840,000 downloads that hijacked affiliate links and enabled ad fraud.
The extensions on Chrome, Firefox, and Edge monitored user activity and installed backdoors.
The campaign is linked to GhostPoster, previously identified in December 2025.
Separately, the KongTuke traffic distribution system redirects users to malicious extensions such as NexShield, which masquerades as an ad blocker, crashes browsers, and delivers further malware.