Microsoft removes 119 StegoAd Edge extensions carrying credential-stealing code
StegoAd hid malicious code in 119 Edge extensions with up to 2.6 million installations. Payloads could steal passwords, sign-in codes and cookies. Microsoft removed the listings; check extension IDs, remove matches and secure sensitive accounts.
Open edge://extensions and compare extension IDs with the list linked from Microsoft's advisory; remove any matches. If you had one installed, change sensitive account passwords and review sign-in activity, including Google, banking and WordPress accounts. Keep Edge updated and use strong two-factor authentication, preferably a hardware security key.
- Microsoft Edgeno fixed version yet
What’s happening
StegoAd targeted people using Microsoft Edge extensions presented as ad blockers, VPNs, translators and other useful tools. The extensions provided real features while concealing malicious code in image and font files or retrieving it later. Retrieved payloads could capture Google passwords and second-factor codes, collect WordPress administrator logins, steal browser cookies and run additional code. The campaign also manipulated adverts, shopping referrals and search results. Microsoft removed all 119 identified extensions and suspended more than 90 developer accounts. The figure of up to 2.6 million installations is not a confirmed victim count: delayed and selective activation meant some installations never ran the payloads. This requires removing malicious extensions and securing accounts rather than installing a fixed extension version. No later resolution was found by 3 November; Microsoft's statement says the operator remains active.
- What
- Poisoned software
- Affects
- Microsoft Edge extensions distributed through Edge Add-ons
- Affected
- 119 malicious Microsoft Edge extensions identified in Microsoft's StegoAd report; no affected version ranges stated
- Fixed in
- Nothing to patch
- Since
- 16 June 2026
- Closed
- 29 June 2026
Timeline
- Update
Malwarebytes published an extension-name and ID list to help users identify affected installations. It warned that names alone could match other extensions and advised removing the malicious ones.
- Update
By publication, Microsoft had removed all 119 identified extensions from Edge Add-ons, suspended more than 90 developer accounts and strengthened detection. It said the operator remained active.
- Made publicNothing to patch
Microsoft disclosed StegoAd: 119 malicious Edge extensions with up to 2.6 million installations. It traced the operator's activity to at least 2021, but said malicious payloads did not execute in every installation.
Sources
- Inside StegoAd: How We Disrupted a Massive Malicious Extension CampaignMicrosoft · 16 June 2026
- 119 Edge extensions promised useful tools, instead downloaded malwareMalwarebytes · 29 June 2026
- Microsoft Removes 119 Edge Extensions That Hid Malware in Images and FontsThe Hacker News · 29 June 2026