GhostPoster Firefox add-on malware payload with affiliate-hijacking toolkit
Malware Activity
Summary
Hide ▲
Show ▼
The GhostPoster malware operation is abusing 17 Firefox add-ons to deliver malicious JavaScript that hijacks affiliate links and injects tracking code, exposing users to fraud and browser surveillance. The add-ons were collectively downloaded 50,000+ times, widening the reach of the payload. The same code also strips browser security protections and can open a backdoor for remote code execution. Delivery relies on external infrastructure including www.liveupdt[.]com and www.dealctr[.]com.
Related Happenings
PhantomRaven npm supply-chain campaign
Campaign
H score16
First: 11.03.2026 19:09
Last: 11.03.2026 19:09
Sources 1
About this happening:
PhantomRaven is an active npm supply-chain campaign that began in August 2025 and has grown to 126 npm libraries with more than 86,000 installs. The packages h...
PhantomRaven npm supply-chain campaign
CampaignAbout this happening: PhantomRaven is an active npm supply-chain campaign that began in August 2025 and has grown to 126 npm libraries with more than 86,000 installs. The packages h...
GhostPoster malicious browser extension campaign across Chrome, Firefox, and Edge
Campaign
H score25
First: 17.01.2026 17:23
Last: 17.01.2026 17:23
Sources 1
How related:
A new campaign named GhostPoster has leveraged logo files associated with 17 Mozilla Firefox browser add-ons to embed malicious JavaScript code designed to hijack affiliate links, inject tracking code, and commit click and ad fraud.
About this happening:
The GhostPoster campaign resurfaced with 17 malicious extensions in Chrome, Firefox, and Edge, putting users at risk of browser monitoring, affiliate-link hijack...
GhostPoster malicious browser extension campaign across Chrome, Firefox, and Edge
CampaignHow related: A new campaign named GhostPoster has leveraged logo files associated with 17 Mozilla Firefox browser add-ons to embed malicious JavaScript code designed to hijack affiliate links, inject tracking code, and commit click and ad fraud.
About this happening: The GhostPoster campaign resurfaced with 17 malicious extensions in Chrome, Firefox, and Edge, putting users at risk of browser monitoring, affiliate-link hijack...
Major web skimming campaign targeting payment networks
Campaign
H score36
First: 13.01.2026 19:30
Last: 13.01.2026 19:30
Sources 1
About this happening:
A long-running Magecart web-skimming campaign has been active since 2022 and targets checkout flows tied to American Express, Diners Club, Discover, JCB, Mastercard, and...
Major web skimming campaign targeting payment networks
CampaignAbout this happening: A long-running Magecart web-skimming campaign has been active since 2022 and targets checkout flows tied to American Express, Diners Club, Discover, JCB, Mastercard, and...
ShadyPanda browser extension spyware activity
Malware Activity
H score49
First: 01.12.2025 19:29
Last: 01.12.2025 19:29
Sources 1
About this happening:
ShadyPanda browser extensions now deliver hourly remote code execution, turning trusted add-ons into spyware across Chrome and Edge and putting 4.3 million insta...
ShadyPanda browser extension spyware activity
Malware ActivityAbout this happening: ShadyPanda browser extensions now deliver hourly remote code execution, turning trusted add-ons into spyware across Chrome and Edge and putting 4.3 million insta...
ShadyPanda browser-extension campaign
Campaign
H score58
First: 01.12.2025 17:01
Last: 01.12.2025 17:01
Sources 1
About this happening:
The ShadyPanda browser-extension campaign remains active on Microsoft Edge Add-ons, where it has reached over 4.3 million installs and is still delivering malicious co...
ShadyPanda browser-extension campaign
CampaignAbout this happening: The ShadyPanda browser-extension campaign remains active on Microsoft Edge Add-ons, where it has reached over 4.3 million installs and is still delivering malicious co...
Timeline
-
17.12.2025 10:14 2 articles · 7mo ago
GhostPoster discovered in 17 Firefox add-ons
Initial DisclosureKoi Security identifies GhostPoster in 17 Mozilla Firefox browser add-ons that were collectively downloaded over 50,000 times, and says the add-ons hide malicious JavaScript in logo files to hijack affiliate links, inject Google Analytics tracking code, strip Content-Security-Policy and X-Frame-Options, and support click and ad fraud, CAPTCHA bypass, hidden iframe injection, and a remote-code-execution backdoor through www.liveupdt[.]com and www.dealctr[.]com.
Show sources
- GhostPoster Malware Found in 17 Firefox Add-ons with 50,000+ Downloads — thehackernews.com — 17.12.2025 10:14
- GhostPoster Malware Found in 17 Firefox Add-ons with 50,000+ Downloads — thehackernews.com — 17.12.2025 10:14