17 Malicious Browser Extensions Spanning Firefox, Chrome, Edge Exposed

Security researchers at LayerX disclosed 17 malicious browser extensions across Firefox, Chrome and Edge that were downloaded more than 840,000 times and could stay active for years. Mozilla and Microsoft have removed them from official stores; users who installed any should uninstall immediately. The GhostPoster campaign used steganography to hide code and delayed execution to cloak malicious actions, including rewriting HTTP headers, hijacking affiliate traffic, injecting scripts for click fraud and user tracking, auto-solving CAPTCHAs, and granting attackers extended control. Notable extensions included Google Translate in Right Click and Translate Selected Text with Google, with Urban VPN Proxy cited as another high-risk example.