{"id":"edge-stegoad-malicious-extensions-jun-2026","category":"supply-chain","status":"closed","title":"Microsoft removes 119 StegoAd Edge extensions carrying credential-stealing code","tldr":"StegoAd hid malicious code in 119 Edge extensions with up to 2.6 million installations. Payloads could steal passwords, sign-in codes and cookies. Microsoft removed the listings; check extension IDs, remove matches and secure sensitive accounts.","summary":"StegoAd targeted people using Microsoft Edge extensions presented as ad blockers, VPNs, translators and other useful tools. The extensions provided real features while concealing malicious code in image and font files or retrieving it later. Retrieved payloads could capture Google passwords and second-factor codes, collect WordPress administrator logins, steal browser cookies and run additional code. The campaign also manipulated adverts, shopping referrals and search results. Microsoft removed all 119 identified extensions and suspended more than 90 developer accounts. The figure of up to 2.6 million installations is not a confirmed victim count: delayed and selective activation meant some installations never ran the payloads. This requires removing malicious extensions and securing accounts rather than installing a fixed extension version. No later resolution was found by 3 November; Microsoft's statement says the operator remains active.","action":"Open edge://extensions and compare extension IDs with the list linked from Microsoft's advisory; remove any matches. If you had one installed, change sensitive account passwords and review sign-in activity, including Google, banking and WordPress accounts. Keep Edge updated and use strong two-factor authentication, preferably a hardware security key.","product":"Microsoft Edge extensions distributed through Edge Add-ons","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["microsoft","edge","browser-extensions","supply-chain","credential-theft","stegoad"],"affected":["119 malicious Microsoft Edge extensions identified in Microsoft's StegoAd report; no affected version ranges stated"],"fixed":[],"matches":[{"platform":"edge","app":"Microsoft Edge","bundle":"","fixed":""}],"sources":[{"kind":"advisory","title":"Inside StegoAd: How We Disrupted a Massive Malicious Extension Campaign","url":"https://microsoftedge.github.io/edgevr/posts/Inside-StegoAd-How-We-Disrupted-a-Massive-Malicious-Extension-Campaign/","by":"Microsoft","date":"2026-06-16"},{"kind":"news","title":"119 Edge extensions promised useful tools, instead downloaded malware","url":"https://www.malwarebytes.com/blog/news/2026/06/119-edge-extensions-promised-useful-tools-instead-downloaded-malware","by":"Malwarebytes","date":"2026-06-29"},{"kind":"news","title":"Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts","url":"https://thehackernews.com/2026/06/microsoft-removes-119-edge-extensions.html","by":"The Hacker News","date":"2026-06-29"}],"started":"2026-06-16","closed":"2026-06-29","created":"2026-11-03T21:07:05.754Z","updated":"2026-11-03T21:07:05.754Z","cve_notes":[],"timeline":[{"at":"2026-06-29","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Malwarebytes published an extension-name and ID list to help users identify affected installations. It warned that names alone could match other extensions and advised removing the malicious ones.","url":"https://www.malwarebytes.com/blog/news/2026/06/119-edge-extensions-promised-useful-tools-instead-downloaded-malware","by":"Malwarebytes","patch":null},{"at":"2026-06-16","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"By publication, Microsoft had removed all 119 identified extensions from Edge Add-ons, suspended more than 90 developer accounts and strengthened detection. It said the operator remained active.","url":"https://microsoftedge.github.io/edgevr/posts/Inside-StegoAd-How-We-Disrupted-a-Massive-Malicious-Extension-Campaign/","by":"Microsoft","patch":null},{"at":"2026-06-16","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Microsoft disclosed StegoAd: 119 malicious Edge extensions with up to 2.6 million installations. It traced the operator's activity to at least 2021, but said malicious payloads did not execute in every installation.","url":"https://microsoftedge.github.io/edgevr/posts/Inside-StegoAd-How-We-Disrupted-a-Massive-Malicious-Extension-Campaign/","by":"Microsoft","patch":"na"}],"url":"https://hard.fyi/live/edge-stegoad-malicious-extensions-jun-2026/","json":"https://hard.fyi/api/live?id=edge-stegoad-malicious-extensions-jun-2026"}