CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

DarkSpectre Campaigns Target 8.8 Million Users with Malicious Browser Extensions

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A Chinese threat actor, DarkSpectre, has been linked to three malicious browser extension campaigns—ShadyPanda, GhostPoster, and The Zoom Stealer—which have collectively impacted 8.8 million users across Google Chrome, Microsoft Edge, and Mozilla Firefox over seven years. The campaigns facilitate data theft, search query hijacking, affiliate fraud, and corporate espionage by exfiltrating meeting-related data from video conferencing platforms. The extensions, some of which are still active, use delayed activation and benign updates to evade detection and build trust before deploying malicious functionality.

Timeline

  1. 31.12.2025 18:14 1 articles · 23h ago

    DarkSpectre Linked to Three Malicious Browser Extension Campaigns

    DarkSpectre, a Chinese threat actor, has been attributed to three campaigns—ShadyPanda, GhostPoster, and The Zoom Stealer—impacting 8.8 million users. The campaigns involve data theft, affiliate fraud, and corporate espionage, with some extensions still active and others dormant, awaiting malicious updates.

    Show sources
    Open in new tab

Information Snippets