Topic: Chrome

GhostPoster refers to a campaign of malicious browser extensions that use steganography within PNG icon files to deliver obscured JavaScript payloads. Initially discovered by Koi Security affecting Firefox users, LayerX later found 17 additional extensions targeting Edge and Chrome, with over 840,000 downloads and installations, some active for up to five years. These extensions perform actions like hijacking affiliate traffic, click fraud, and injecting malicious scripts, highlighting the challenge of detecting stealthy malware.