Malware hidden in extension icons: how to check your browser for GhostPoster

Almost every tool that screens browser extensions reads the code. GhostPoster hid its malware somewhere nobody was looking — inside the extension's own icon. A PNG file, the little picture you see next to the extension's name, was carrying the payload the whole time.

That trick let a batch of 17 extensions rack up around 840,000 installs across Chrome, Firefox, and Edge, with some of them running quietly for as long as five years before anyone noticed. If you've installed a translate helper, an ad blocker, or a downloader from any of the big stores, this one's worth two minutes of your attention.

What GhostPoster actually did

The campaign was first flagged by researchers at Koi Security and then expanded by LayerX Security, which mapped 17 malicious extensions spread across all three major browser stores. According to BleepingComputer's reporting, those extensions had roughly 840,000 combined installs. A single one — a Google Translate knockoff called "Google Translate in Right Click" — accounted for 522,398 of them on its own. To be clear, that was an impersonator riding on the Google Translate name, not anything Google built.

Here's the clever part, and the reason it stayed hidden so long. Instead of shipping obviously malicious JavaScript, the extensions packed their loader into the raw bytes of the icon image. As LayerX laid out in its writeup, the background script scanned the icon's bytes for a specific delimiter — >>>>, or [62,62,62,62] in byte values — and everything after that marker got extracted and executed.

The visible part of the file is a normal-looking logo. The tail end is a program.

This is steganography: hiding data inside other data. Store reviewers and automated scanners overwhelmingly inspect the JavaScript files in an extension bundle, not the pixels of a logo. By moving the live code into an image asset, GhostPoster walked straight past the part of the review process designed to catch it. SecurityWeek covered the same icon-hiding technique on the Firefox side of the campaign.

How a logo becomes a program

If you've never thought about it, here's why this works. A PNG file has a defined structure — a header, the image data, an end marker — but nothing stops you from appending extra bytes after the image officially "ends." Your image viewer reads up to that end marker, renders a perfectly normal logo, and ignores the rest. The bytes you tacked on are still sitting there in the file, invisible to anyone looking at the picture.

GhostPoster's background script knew exactly where to look. It read the icon as raw bytes, scanned for the >>>> delimiter, and treated everything after it as code to run. The extension didn't need to download anything suspicious on first launch, and it didn't need a single line of obviously dangerous JavaScript in its source files. The dangerous part shipped inside an asset that looks like decoration.

That's the gap. Most extension security checks — store review, open-source scanners, even a curious developer reading the source — assume the threat lives in the .js files. They diff the code, they flag risky API calls, they check the permissions in the manifest.

Almost none of them disassemble a PNG to see whether it's secretly a payload. The attackers picked the one part of the bundle nobody audits.

The patience was the point

What made GhostPoster nasty wasn't just where it hid — it's how slowly it moved. LayerX found that the malware contacted its command-and-control server in only about 10% of successful connections. That sounds like a bug. It's actually a design choice: if the bad behavior only fires one time in ten, automated sandboxes that run an extension for a few minutes will usually see nothing at all.

Once it did activate, the payload wasn't subtle about making money. Researchers documented affiliate-link hijacking on major e-commerce sites (your purchase quietly credits the attacker's referral code), invisible iframe injection for ad and click fraud, general browsing-activity tracking, and the stripping of HTTP security headers — which knocks down protections that would otherwise block cross-site scripting. LayerX also described a newer variant showing, in their words, "longer dormancy, modularity, and resilience against both static and behavioral detection mechanisms." Translation: the next version is built to hide even better.

Stack those behaviors up and you get a quiet, diversified money machine. Affiliate hijacking skims a cut off your real purchases. The invisible iframes load ads you never see and "click" them in the background, billing advertisers for impressions and clicks that no human ever made. The browsing tracking turns your habits into a sellable data stream.

None of it interrupts you, none of it pops a scary dialog — and that's exactly why an infection could sit on a machine for years. There was no moment where the extension obviously broke. It just earned someone money off your browser while you used it normally.

The longevity here is genuinely unusual. According to LayerX, parts of the campaign trace back to around 2020, meaning some extensions ran maliciously for up to five years before takedown. That's not a smash-and-grab. It's a business that depended on staying boring enough to never get a second look.

Why this matters for you

The headline most people take away from stories like this is "the bad extensions got removed, problem solved." It isn't. Google, Mozilla, and Microsoft all pulled the identified extensions from their stores — but a store removal only stops new installs.

If one of these was already sitting in your browser, it kept running. There's no automatic uninstall pushed to your machine, no notification, nothing. The cleanup is on you.

The cross-browser angle matters too. GhostPoster started on Edge, then spread to Firefox and Chrome, which means "I don't use Chrome" was never a defense. No single store's review process caught it, because the whole approach was built to defeat the kind of review every store relies on. This is the same long-dormancy, multi-store pattern I dug into in my piece on cross-browser sleeper extensions — GhostPoster is just an unusually patient example of it.

And the usual trust signals didn't help here. Half a million people installed that fake Google Translate menu, which means the install count looked reassuring rather than suspicious. The reviews were presumably fine, because for years the extension did its visible job and only misbehaved in the background one connection in ten.

The lesson isn't "be paranoid about popular extensions" — it's that popularity and a clean review history tell you an extension is useful, not that it's safe. Those are different questions, and the store listing only answers the first one.

How to protect yourself

You don't need to panic-uninstall everything. A focused pass does the job.

1. Open your extensions page and actually read the list. chrome://extensions, about:addons in Firefox, edge://extensions. Remove anything you don't recognize or haven't used in months. Dormant extensions are pure downside — they keep their permissions whether you use them or not.

2. Be suspicious of utility clones. GhostPoster leaned on the most boring, useful-sounding categories: translate helpers, ad blockers, downloaders. Before installing one, check the publisher name, the review history, and whether the listing feels like a copy of a more popular tool. A 500k-install "Google Translate" right-click menu that isn't from Google is exactly the shape of this attack.

3. Watch for behavioral tells. Shopping links that bounce through a redirect you didn't expect, new tabs you didn't open, pages feeling sluggish, or your ad blocker mysteriously "not working" can all point to an extension misbehaving in the background.

4. If you find a suspect, clean up after it. Because this malware tracked browsing and stripped security headers, removing the extension isn't the end. Clear your cookies for sensitive sites and reset passwords for anything important you used while it was installed.

5. Judge extensions by behavior, not just permissions. A steganography loader doesn't need scary permissions to do damage — it needs the ability to run a content script and make a network call, which is most extensions. The useful question isn't "what can it access" but "what is it actually doing."

How Extenshi helps

That last point is the whole reason I built Extenshi the way I did. A permission list tells you what an extension could do; it won't tell you that the friendly logo is smuggling a payload. Extenshi looks at the actual behavior — the network endpoints an extension talks to and the patterns that match known campaigns like this one — so a dormant or icon-hidden loader has somewhere to show up even when the manifest looks clean.

If you've got a drawer full of extensions you half-remember installing, start there. Scan your extensions → and see what each one is really reaching out to, or browse the catalog to check an extension's security report before you install it. For more on how long-running campaigns stay hidden in plain sight, my breakdown of the ShadyPanda campaign covers the same evade-then-activate playbook at a much larger scale.

---

This article is based on publicly available security research and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].