Observed Signal · Jun 30, 2026 · Security Disclosure · Source: t3n · Impact: 4/5 · Sentiment: Negative
Microsoft exposes 'StegoAd' malware in browser extensions
Microsoft disclosed a sophisticated malware campaign called “StegoAd” that infected 119 browser extensions since 2021 and was installed up to 2.6 million times. The attackers used steganography — hiding malicious code inside seemingly harmless PNG images — to deliver payloads days after initial extension installation. The malware replaced affiliate links, stole cookies and session data (enabling account takeover), downloaded additional tools aimed at stealing Google and WordPress credentials, and could enable remote control of infected devices. Microsoft removed all 119 extensions from the Edge add‑on store, suspended over 90 developer accounts, and shared technical details with other browser developers (including Chrome and Firefox) to help detection and mitigation.
A major platform security disclosure from Microsoft reveals large-scale ad-fraud and malware in widely installed browser extensions (millions of installs), affecting affiliate flows, session security and account integrity — removal and cross-browser sharing of indicators can materially affect trust, detection, and platform security practices across the ecosystem.
Track Microsoft Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Microsoft named the campaign "StegoAd" and published findings on GitHub.
- 119 browser extensions were found infected since 2021, with up to 2.6 million installs in total.
- Microsoft removed all 119 extensions from the Edge add‑on store and suspended more than 90 developer accounts.
- The malware used steganography by downloading a PNG image that concealed malicious code, enabling delayed activation several days after install.
- Observed abuse included affiliate link replacement (targeting Amazon, eBay, AliExpress), cookie/session theft and additional downloads aimed at stealing Google and WordPress accounts or enabling remote control.
Connected Companies & Entities
8 Entities mapped“Microsoft has now uncovered such a case; Microsoft wrote on GitHub about the campaign, calling it one of the most sophisticated they had see...”
“Here you find external content from TargetVideo GmbH that supplements our editorial offering on t3n.de....”
“Here you find external content from YouTube Video that supplements our editorial offering on t3n.de....”
“If users purchased on Amazon, eBay or AliExpress, the cybercriminals earned directly from it....”
“If users purchased on Amazon, eBay or AliExpress, the cybercriminals earned directly from it....”
“If users purchased on Amazon, eBay or AliExpress, the cybercriminals earned directly from it....”
“The report says additional data was downloaded that was intended to steal Google and WordPress accounts....”
“Microsoft provided the information about the attacks to other browsers and their developers, including Chrome and Firefox....”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Researchers Find 108 Malicious Chrome Extensions
A security research team at supply‑chain security firm Socket discovered 108 malicious Chrome extensions that have been downloaded more than 20,000 times. The extensions, linked to five operators (Yana Project, Game Gen, Side Games, Rodeo Games and Inter Alt), inject unsolicited advertising across visited websites and exfiltrate user data to a common command‑and‑control server, suggesting a coordinated campaign. Identified add‑ons span categories such as YouTube/TikTok web clients, games, Wi‑Fi speed tests and translation tools. The researchers found 45 extensions with a universal backdoor that opens arbitrary URLs at browser start, 54 that steal Google account identities, and one that transmits Telegram session data every 15 seconds. Socket recommends users remove any of the listed extensions via Chrome’s Extensions manager and publishes the full list on its site.
Monster Jam Primetime Series Debuts Oct 1 on FAST Platforms
Monster Jam announced that its weekly streaming series, Monster Jam Primetime, will debut on October 1, 2026, at 8 p.m. ET on the Monster Jam Channel. Two new episodes will premiere every Thursday across nine free ad-supported streaming television (FAST) platforms, including Amazon Prime Video, The Roku Channel, VIZIO WatchFree+, Pluto TV, LG Channels, Plex, Local Now, Rakuten TV, and Xumo Play. Episodes will also be available on the Monster Jam YouTube channel. The series features highlights from the 2026 season, including Racing, Skills competitions, and Freestyle, with analysis and behind-the-scenes content.
NBCUniversal Cuts Hundreds of Streaming Jobs
NBCUniversal is cutting hundreds of employees from its global streaming technology organization, with the deepest impact on its European Sky unit and some US-based staff. The reductions, affecting engineering and quality-assurance roles supporting streaming products, were announced internally on Wednesday. Due to UK labor rules, Sky-side dismissals will follow a consultation period. The move comes as Comcast prepares to spin off NBCUniversal, including Peacock and Sky, next summer. Company leaders frame the reorganization as aligning resources with future growth and ensuring effective operation post-separation. Peacock recently reported its first adjusted EBITDA profitability, but investor pressure on traditional media remains. The cuts follow an earlier round in March after Showmax shut down.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.