A malicious or hijacked extension in Chrome, Firefox or Edge.
28 real attacks
November 2, 2026
Anthropic says the trojanized Claude Code extension was not its breach. Technical staffer Felix Rieseberg stated a malicious actor used access to Cursor's marketplace to publish a tampered copy that Anthropic neither built nor published, and that official channels are unaffected. Cursor puts the exposure window at roughly 11 hours (09:27–20:35 UTC Thursday) for v2.1.313; The Register cites claims of up to 5,000 affected developers. Both vendors echo Phorion's finding that the reverse SSH tunnel script needed admin rights on macOS and Windows that it usually did not have, so it failed in most cases. Neither company has explained how the package reached the marketplace (The Register, The Hacker News, earlier coverage) (discussion).
· Supply Chain
November 1, 2026
Expel's IR work on the trojanized Claude Code extension found live reverse SSH tunnels. Across four affected customer Macs, Expel observed outbound reverse SSH to the attacker server, with one host first running the malware roughly eight hours after the end of Cursor's stated exposure window. Cursor's revised notice names two tampered Anthropic.claude-code builds — 2.1.312 and 2.1.313 — with corrected IOCs worth re-pulling (Expel). Anthropic's statement puts the compromise squarely at Cursor's marketplace (Kevin Beaumont); earlier coverage.
· AI & Model Security
October 31, 2026
A tampered anthropic.claude-code build (v2.1.313, also 2.1.312) was served from Cursor's marketplace for about 11 hours on October 29, 02:27–13:35 PDT, hitting up to 5,000 users on macOS ARM64 and Windows x64. Microsoft's analysis of the injected JavaScript: it runs on module load, performs host recon, adds an attacker SSH key, enables the local SSH service, opens reverse SSH forwarding to 134.209.82.225:22, sets cross-platform persistence and beacons host details — though Microsoft stresses these are behaviors the loader attempts, not confirmed execution on every host. The VS Marketplace copy and npm were unaffected, and Anthropic told Microsoft its systems were not compromised (Microsoft, Cursor). Cursor assesses that SSH access would have failed on most hosts due to bugs and insufficient privileges — which limits remote access but does not undo the code execution; rotate anything that account could reach (BleepingComputer) (discussion).
· Supply Chain & Developer Tooling
Yoba lures victims to fake GitHub "AI desktop app" repos and sideloads DLLs via signed ChatGPT and Claude binaries, with anti-analysis checks and a Telegram/DGA plus DoH C2 chain (Ed25519-signed, AES-encrypted) that currently drops XMRig but is a generic loader (Check Point). Separately, a Chinese-speaking actor is SEO-poisoning DeepSeek download searches to deliver Kong RAT through a multi-stage chain (Hybrid Analysis).
· Threat Activity
· also via seo poisoning
October 10, 2026
Crypto wallet extensions, two clusters: 16 malicious Firefox add-ons impersonating Rabby and OKX intercept recovery phrases and private keys during import flows (The Hacker News), and Unit 42 found nine extensions advertised as simple utilities that render as wallets on open, targeting both hot and hardware wallets (Unit 42).
· Threat Activity
September 24, 2026
Google pulled a cluster of Chrome extensions that enrolled browsers into the Mellowtel scraping botnet, with Spur measuring the proxy node count falling from around 90,000 (Catalin Cimpanu).
· Threat Activity
September 15, 2026
“Twitch Enhanced Viewer | JeetBot” exposed live Twitch OAuth tokens to operator-controlled proxies.Socket found that version 85.x placed tokens in an auth query parameter for every watched channel except ten hardcoded Russian-language channels, making them available in proxy logs. Store listings showed roughly 31,000 users across Chrome and Firefox; tokens could reach chat, whispers, and account settings. Both add-ons were still listed on September 14, The Hacker News reports.
· Cloud, Identity & Supply Chain
August 29, 2026
18 Chrome and one Edge extension published over the past six months shipped wallet-secret theft and crypto-draining code, sharing enough code and tradecraft to indicate a single cluster, per Socket (The Hacker News).
· Threat Activity
August 21, 2026
40 malicious Firefox extensions impersonate OKX, Rabby Wallet and TronLink to steal wallet secrets, part of a wider set of 77 add-ons sharing code and infrastructure in a campaign Socket calls Offside Wallet Theft Factory (The Hacker News).
· Supply Chain
August 13, 2026
A new "SaassyCode" campaign is pushing malicious VS Code extensions: Nextron's scanner flagged "Trello Board" (TrelloWorks.trello-board), which downloads and runs a BAT loader on startup, sets scheduled-task persistence, and injects shellcode into trusted Windows processes — part of the same wave of Marketplace abuse that has also carried XWorm, per Knostic's analysis.
· Threat Activity
737 Chrome "VPN" extensions were caught routing browser traffic through proxy infrastructure, largely targeting Russian-speaking users; 274 impersonate 66 legitimate brands and racked up ~75,000 installs across 40+ developer accounts, per The Hacker News and BleepingComputer.
· Threat Activity
August 12, 2026
A threat actor keeps pushing XWorm-laden extensions to the VS Code Marketplace. One activated at startup, claimed it needed elevated permissions to "sync board data securely," relaunched VS Code as admin, then added Defender exclusions and pulled a PowerShell stager to drop a fake svchost.exe (Nextron gist).
· Threat Activity
August 11, 2026
A malicious VS Code extension, "Solidity Pro," steals crypto wallets, API keys, and credentials. Two variants (helper-beeps.solidity-pro, web3devtoolsx.solidity-pro) delivered a browser-wallet and credential stealer before being pulled from Open VSX (The Hacker News).
· Supply Chain
August 6, 2026
Open VSX removed 77 "evil twin" extensions that impersonated legitimate developer tools while exfiltrating host and dev-environment data; the packages were uploaded between July 26 and August 1 and flagged by Manifold Security (The Hacker News, BleepingComputer).
· Supply Chain
July 30, 2026
15+ Chrome productivity extensions bundle an undisclosed SDK that turns the browser into a covert web-crawling proxy, per Unit 42 — no mention of crawling in the store listing, only a post-install opt-in popup. Unit 42
· Threat Intelligence & Research
July 26, 2026
A featured Chrome extension, "Planet Search" (2M installs, publisher FREE VPN PLANET SRL), routes every query to the nextgeeker[.]com hijacker network, per malext.io via @Dinosn.
· Threat Activity
July 25, 2026
UAC-0099 hides MATCHBOIL.V2 in a fake Notepad++ plugin. CERT-UA attributes a new campaign using a malicious Notepad++ plugin to backdoor Windows systems to the Russia-aligned cluster. The Hacker News.
· Threat Activity
July 22, 2026
Attackers used AI to bulk-generate 350+ new fake VPN browser extensions across 47 accounts since Unit 42's first report, backed by 30 proxy backend domains on .space and .online TLDs and 3,000+ installs. Unit 42.
· Threat Activity
July 16, 2026
ExporTheft: 11 "AI Chat Exporter" Chrome extensions exfiltrate full chat content on PDF export despite store listings claiming "No uploads to external servers." malext.io
· Supply Chain
July 14, 2026
Google and Microsoft pulled ModHeader (~1.6M installs) from Chrome and Edge after researchers found a hidden, dormant browsing-history collector in the official store build; an empty allow-list had kept it switched off with no evidence it ever fired. The Hacker News
· Malware
July 5, 2026
North Korea's PolinRider campaign publishes 108 malicious packages/extensions across npm, Packagist, Go, and the Chrome Web Store, linked to the ongoing Contagious Interview cluster. Compromised maintainer accounts mean the count is expected to grow. The Hacker News
· Threat Activity
· also via package registry
July 3, 2026
CERT.dk flagged a malicious "Perplexity" browser extension that captured user searches and keystrokes. CERT.dk.
· AI & Model Security
June 30, 2026
Microsoft removed 119 Edge extensions (2.6M installs) in the StegoAd campaign, which hid payloads inside image and font files via steganography and activated days after install to steal credentials and run ad fraud. A separate fake Perplexity Chrome extension was found logging every search and address-bar keystroke. The Hacker News, Malwarebytes, Perplexity ext.
· Threat Activity
June 29, 2026
119 malicious extensions were found on the official Microsoft Edge Add-ons store. (blackorbird)
· Threat Activity
June 18, 2026
15 malicious JetBrains Marketplace plugins, all posing as DeepSeek-based AI coding assistants, exfiltrated developers' AI provider API keys — paired with Chrome extensions capturing chatbot conversations (BleepingComputer, Aikido).
· AI & Model Security
· also via package registry
Steam Workshop / Wallpaper Engine abused to distribute account-stealing malware, alongside 152 trojanized Chrome wallpaper extensions (105K installs) faking ad traffic (Securelist, The Hacker News).
· Threat Activity & Ransomware
June 17, 2026
15 malicious JetBrains Marketplace plugins, all posing as DeepSeek/LLM-based coding assistants, were published in a coordinated campaign to exfiltrate developers' AI provider keys. The Hacker News, BleepingComputer.
· AI & Model Security