ShadyPanda Browser Malware Guide

A massive malware campaign dubbed "ShadyPanda" has been uncovered, infecting over 4.3 million users across Google Chrome and Microsoft Edge. This sophisticated operation leveraged seemingly legitimate browser extensions to spy on users, hijack searches, and even execute malicious code.

If you use browser extensions for productivity or customization, your browser might be compromised. Here is everything you need to know about ShadyPanda and how to clean your system.

The "ShadyPanda" Modus Operandi

The ShadyPanda campaign is unique because it played the long game. Many of the malicious extensions were published years ago, functioning as legitimate tools to build a user base and gain trust. In mid-2024, the attackers pushed malicious updates to these extensions, weaponizing them overnight.

Key Malicious Activities

Data Exfiltration: Collecting browsing history, cookies, and browser fingerprints.
Search Hijacking: Redirecting user searches through affiliate networks to generate revenue.
Remote Code Execution (RCE): The most dangerous capability, allowing attackers to run arbitrary commands on the victim's machine.
Session Cookie Theft: Stealing authenticated session tokens to access logged-in accounts without knowing the password.
Keylogging: Recording keystrokes in sensitive input fields, including passwords and credit card numbers.

How Browser Extensions Can Execute Malicious Code

To understand why ShadyPanda was so effective, it helps to understand how browser extensions actually work. Extensions run with elevated browser permissions defined at install time. Depending on what the user approves, an extension can:

Read and modify all content on every webpage you visit
Access your browser history and bookmarks
Intercept network requests before they leave your browser
Communicate with external servers in the background
Inject JavaScript into any page, including banking and email

The key attack vector ShadyPanda used was a background service worker that persisted even when no browser tab was open, silently exfiltrating data to command-and-control servers hosted on bulletproof hosting in Russia and Eastern Europe.

The malicious update also exploited Chrome's chrome.cookies API — a permission many extensions legitimately request — to read all stored cookies, including session tokens that allowed attackers to bypass multi-factor authentication on popular platforms.

List of Known Malicious Extensions

Security researchers have identified dozens of extensions linked to this campaign. The most prominent include:

Clean Master (Chrome): Masquerading as a cache cleaner, this extension had over 300,000 installs and was even "Verified" by Google before being weaponized.
WeTab (Edge): A "new tab" customization tool with over 3 million installs that acted as spyware.
Infinity V+: A productivity extension used for search hijacking and keylogging.
Extensions by "Zhang" and "nuggetsno15": A collection of over 140 wallpaper and utility extensions used for affiliate fraud.
PDF Merge and Edit tools: A cluster of document productivity tools used to capture uploaded document content.
VPN extensions with "free" tier: Several free VPN browser extensions were found routing traffic through attacker-controlled proxies, enabling full man-in-the-middle inspection of HTTP traffic.

If you have any of the above extensions installed, or if you have noticed unusual browser behavior, treat the situation as a confirmed compromise.

Technical Indicators of Compromise (IOCs)

Security analysts can look for the following indicators:

Network traffic to unusual .xyz, .top, or .icu domains from browser processes
Registry entries under HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions for extensions not explicitly installed
Unusual background processes: chrome.exe or msedge.exe with high CPU when the browser is closed or idle
File writes to %AppData%\Local\Google\Chrome\User Data\Default\Extensions\ from unexpected processes

For enterprise environments, these IOCs can be fed into SIEM rules to detect lateral spread across employee machines.

How to Check and Remove the Malware

Step 1: Audit Your Extensions

Chrome: Go to chrome://extensions
Edge: Go to edge://extensions
Remove any extension you do not recognize or that matches the names above. If you did not deliberately install it, remove it.

Step 2: Reset Your Browser

Malware often changes deep settings that uninstalling an extension will not fix.

Chrome: Go to Settings > Reset settings > Restore settings to their original defaults
Edge: Go to Settings > Reset settings

Note that resetting your browser will clear saved passwords, autofill data, and custom settings. Export any saved passwords to a password manager first.

Step 3: Clear All Browsing Data

Clear cookies, cache, and site data. This removes tracking scripts and invalidates stolen session cookies so they cannot be used for further access.

Step 4: Change Passwords for Critical Accounts

Since ShadyPanda could harvest session cookies and keystrokes, assume any account you were logged into during the infection period is compromised. Prioritize:

Email accounts (these allow password reset for everything else)
Banking and financial services
Social media
Any SaaS tools you use for work

Change passwords after cleaning the browser, not before — changing them on an infected browser is counterproductive.

Step 5: Enable Multi-Factor Authentication

Where you have not already done so, enable app-based MFA (Google Authenticator, Microsoft Authenticator, or a hardware key). This ensures that even if session cookies were stolen, attackers cannot maintain persistent access after you terminate their sessions.

Step 6: Run a Full Endpoint Scan

ShadyPanda's RCE capability means some variants may have dropped secondary payloads outside the browser. Run a full scan with Malwarebytes, Microsoft Defender, or your corporate EDR solution to check for persistence mechanisms at the OS level.

Preventing Future Extension-Based Malware

For Individuals

Apply the "minimum necessary" rule: Only install extensions you use daily. Remove everything else.
Check the developer identity: A legitimate extension has a real company name, a privacy policy, and a website. Anonymous publishers are a red flag.
Review permission requests carefully: An extension that claims to "block ads" but requests "read and change all your data on all websites" is requesting far more than it needs.
Watch for update changes: If an extension suddenly requests new permissions after an update, that is a warning sign. Chrome will show a notification when this happens — do not dismiss it without reading it.

For Organizations

Use Chrome Enterprise policies or Microsoft Intune to whitelist approved extensions and block unapproved ones across all managed devices.
Monitor extension telemetry in your EDR or SIEM for new extensions appearing on employee machines outside your approved list.
Conduct periodic extension audits: Quarterly reviews of installed extensions on employee machines can catch compromised tools before they cause damage.
Deploy CASB solutions that can inspect browser traffic and alert on data exfiltration patterns consistent with extension-based malware.

Conclusion

ShadyPanda demonstrates that browser extensions are one of the most underestimated attack surfaces in modern cybersecurity. Unlike traditional malware, extensions are explicitly trusted by the browser, live inside your security perimeter, and operate with permissions you granted voluntarily.

The attack's success — 4.3 million infections across two major browsers — came from exploiting long-established trust rather than a zero-day vulnerability. The defense is straightforward but requires discipline: reduce your extension footprint, verify publisher identity, and treat unusual browser behavior as a security incident until proven otherwise.

If you suspect your organization's devices have been compromised, contact Cyberlord Secure Services for a comprehensive endpoint security assessment and forensic analysis.

Frequently Asked Questions

How do I know if my browser was infected by ShadyPanda? Check your installed extensions against the known malicious list, review your browser for unusual behavior (search redirects, unexpected pop-ups), and run a malware scan. If you had any of the named extensions installed between mid-2024 and early 2026, treat your browser session credentials as compromised.

Can ShadyPanda infect Firefox or Safari? The confirmed campaign targeted Chrome and Edge. Firefox uses a different extension architecture (WebExtensions with stricter permission enforcement), and Safari's App Store extension model makes this specific attack vector harder to execute. However, all browsers are susceptible to malicious extension campaigns in principle.

Does removing the extension remove the malware completely? For most users, yes — combined with a browser reset and password changes. For the subset of infections where the RCE capability was used to drop secondary payloads at the OS level, a full endpoint scan is required to confirm complete removal.