Key findings
- Recent public campaigns involving malicious browser extensions. Several common features were identified amongst the campaigns, such as the release of ‘clean’ extensions to gain trust, silent updates containing the malware, advanced evasion techniques and a focus on the theft of cryptocurrencies and authenticated sessions.
- Known threat actors that actively develop and manage malware masquerading as legitimate extensions. Discussions inside the forums highlight the quest for “silent” extension installation. We also noticed some talks about moderation and long-term stability for extensions on browser stores.
- Details on an incident investigated by our SOC and CTI related to malicious extensions. No evidence of malicious activity was evidenced at this time, but we managed to identify a list of “suspicious” browser extensions.
- Infrastructure analysis and pivots available to detect known malware that can be disguised as legitimate extensions, including Needle and Lunex. IP addresses exposing panels for these malwares were identified.
Intrinsec’s CTI services
Organisations are facing a rise in the sophistication of threat actors and intrusion sets. To address these evolving threats, it is now necessary to take a proactive approach in the detection and analysis of any element deemed malicious. Such a hands-on approach allows companies to anticipate, or at least react as quickly as possible to the compromises they face.
For this report, shared with our clients in March 2026, Intrinsec relied on its Cyber Threat Intelligence service, which provides its customers with high value-added, contextualized and actionable intelligence to understand and contain cyber threats. Our CTI team consolidates data & information gathered from our security monitoring services (SOC, MDR …), our incident response team (CERT-Intrinsec) and custom cyber intelligence generated by our analysts using custom heuristics, honeypots, hunting, reverse-engineering & pivots.
Intrinsec also offers various services around Cyber Threat Intelligence:
- Risk anticipation: which can be leveraged to continuously adapt the detection & response capabilities of our clients’ existing tools (EDR, XDR, SIEM, …) through:
- an operational feed of IOCs based on our exclusive activities.
- threat intel notes & reports, TIP-compliant.
- Digital risk monitoring:
- data leak detection & remediation
- external asset security monitoring (EASM)
- brand protection
For more information, go to intrinsec.com/en/cyber-threat-intelligence/.
