Microsoft’s security team has exposed a sophisticated, large-scale surveillance campaign dubbed SleeperWidget, involving over 250 malicious browser extensions across the Edge, Chrome, and Mozilla marketplaces. These extensions, which masqueraded as innocuous utilities like recipe finders and package trackers, utilized advanced evasion techniques to bypass official store vetting processes. The research highlights how SleeperWidget leveraged paid advertisements to trigger hidden functionality, activating unwanted tracking, aggressive advertising, and deceptive affiliate-link manipulation only after users arrived via specific promotional channels.
This discovery underscores a critical vulnerability in the browser extension ecosystem: the ability for threat actors to weaponize legitimate storefronts by decoupling malicious behavior from standard operation. By delivering genuine functionality alongside covert data harvesting, these extensions successfully avoided detection for an extended period. The campaign serves as a stark reminder of the risks associated with browser add-ons, even those hosted on trusted platforms. For the cybersecurity industry, this incident emphasizes the urgent need for enhanced metadata analysis and infrastructure monitoring to identify coordinated malicious behavior. Users are advised to exercise caution when installing extensions found through sponsored advertisements, as these often serve as the primary gateway for such intrusive digital surveillance operations.
---
📰 Read the full article here
🌐 Visit https://cyberinsider.com
