GhostPoster malware resurges via popular browser extensions with 840k installs

Researchers found 17 GhostPoster-linked extensions in Chrome, Firefox, and Edge totaling about 840,000 installs. The extensions hide malicious JavaScript in their logos to monitor browser activity, hijack affiliate links, and inject invisible iframes for ad and click fraud, pulling a heavily obfuscated payload from an external resource. LayerX reports a more advanced variant that moves the payload into the extension’s background script and stores it inside a bundled image, improving dormancy and evasion. Some extensions have been removed from Mozilla and Microsoft stores; Google has removed them from Chrome Web Store, but users who installed them may still be at risk. The campaign originated on Edge and later spread to other browsers, and the researchers say it remains active.