Key takeaways

LayerX Research (now part of Akamai) discovered a coordinated campaign of 32 malicious browser extensions across the Chrome Web Store and Microsoft Edge Add-ons Store, affecting more than 6,150 users.

The extensions masqueraded as benign productivity utilities (e.g., text counters, note-taking apps, YouTube enhancers) to build trust while secretly harvesting data and monitoring user browsing habits.

Static analysis revealed nearly identical codebases, remote configuration endpoints, and Korean-language development artifacts, strongly tying the cluster to a single Korean-speaking threat actor.

Operators used externally hosted configuration files (deobfuscated at runtime) to manipulate web navigation and execute affiliate fraud without needing to push updates through official store review processes.

Mitigating these dynamic threats requires removing unneeded extensions with broad permissions (webNavigation, <all_urls>), monitoring for remote command and control (C2) infrastructure, and…