Risky Bulletin: Microsoft disrupts StegoAd operation

1. Executive summary

Microsoft's security team has removed 119 malicious Edge extensions from the official Microsoft Edge Add-ons store that were part of a coordinated operation dubbed "StegoAd." The extensions, published across 90+ developer accounts, delivered genuine functionality but deployed malicious payloads three to five days post-install to steal user credentials, backdoor browsers, and conduct advertising and search affiliate fraud. The operation also maintained Chrome and Firefox extensions, with over 2.6 million users believed to have downloaded the group's extensions. Attribution to the actor "StegoAd" is unconfirmed — the named actor has no MITRE ATT&CK profile in verified reference data. No specific CVE, CVSS score, or CISA-KEV entry is associated with this item. EMEA financial services with permissive browser extension policies or bring-your-own-browser (BYOB) environments face credential-theft and session-hijacking risk, particularly from staff who installed utility extensions on work browsers.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Distribution: The threat actor published 119 malicious Edge extensions (plus Chrome and Firefox equivalents) across 90+ different developer accounts on official browser add-on stores. Extensions covered common utility categories: ad blockers, color pickers, AI tools, video downloaders, internet bandwidth optimization tools, weather apps, and PDF editing tools.
2. Initial functionality: All extensions delivered genuine, working functionality upon installation — no immediate malicious behaviour was exhibited, reducing likelihood of user suspicion or automated detection at install time.
3. Delayed activation: Malicious payloads activated three to five days after initial installation. This delay was likely designed to evade automated sandboxing and review processes in browser add-on stores, as well as user scrutiny.
4. Steganographic C2: The operation heavily relied on steganography to hide malicious commands and code inside ordinary image and font files. This served as the command-and-control mechanism — malicious instructions were embedded in what appeared to be benign static assets delivered to the extension.
5. Payload execution: Once activated, extensions performed credential theft, browser backdooring, and advertising/search affiliate fraud. The specific credential-theft mechanism is not detailed in the source material.
6. Evasion evolution: Microsoft described the operators as sophisticated and technically advanced, continually adding and upgrading evasion and C2 techniques. The group successfully ported extensions from Manifest V2 to Manifest V3, despite the latter being designed to boost extension security.
7. Shared infrastructure: Despite being published across 90+ developer accounts, the extensions shared infrastructure and parts of their codebase, enabling Microsoft to correlate and identify the coordinated operation.

Unconfirmed / single-sourced claims (confidence caveat)

• Attribution to the actor "StegoAd" is unconfirmed — no MITRE ATT&CK profile exists in verified reference data. The name is Microsoft's operational designation, not a confirmed threat actor identity.
• The figure of 2.6 million users is described as a belief ("are believed to have downloaded") and Microsoft did not clarify whether this covered all browsers or Edge only. The real number is likely higher given the operation's age and cross-browser sprawl. This is single-sourced to Microsoft; verify before enforcement.
• No specific CVE, CVSS score, or CISA-KEV entry is associated with this item. No specific malware family names, file hashes, domains, IP addresses, or registry keys are provided in the source material.
• The full list of 119 malicious extension names is available in a Microsoft-published PDF referenced in the source but not included in the provided material.

4. Mitigation & containment

P1 — Within 24 hours

• Audit browser extensions enterprise-wide: Query all managed endpoints for installed Edge, Chrome, and Firefox extensions. Export extension inventories via MDM (Microsoft Intune, Jamf, etc.) or endpoint management tooling.
• Cross-reference against the Microsoft PDF list of 119 known malicious StegoAd extensions (referenced in source material). Remove any matches immediately.
• Block extension installation from add-on stores for unmanaged/personal browsers used for work — enforce via Group Policy or MDM:
• Edge: Computer Configuration > Administrative Templates > Microsoft Edge > Extensions > Configure extension installation block list — set to * to block all, then allow-list approved extensions.
• Chrome: ExtensionInstallBlocklist policy set to *, with ExtensionInstallAllowlist for approved extensions only.
• Firefox: extensions.blocklist.enabled = true; use ExtensionSettings policy to restrict installation.

P2 — Within 72 hours

• Force-remove identified malicious extensions from all endpoints via MDM or Group Policy extension force-remove policies.
• Reset credentials for any user found to have had a malicious extension installed. Priorise credentials stored in browser password managers, session tokens, and cookies — these are the primary theft targets.
• Review proxy/egress logs for connections to domains associated with image/font file downloads from browser extension contexts. Steganographic C2 traffic would appear as image/font HTTP(S) requests from extension processes.
• Deploy EDR content inspection rules for image and font files fetched by browser extension subprocesses — flag anomalous entropy or embedded data in PNG, JPEG, GIF, WOFF, TTF files fetched outside normal browsing context.

P3 — Within 7 days

• Implement browser extension allow-listing as standing policy. All extensions must be approved by security team before installation. Document the approval process.
• Update browser security baselines to enforce Manifest V3-only where possible and restrict extension permissions (especially host_permissions, cookies, webRequest).
• Conduct user awareness communications warning staff about the risk of browser extensions, particularly utility extensions (ad blockers, video downloaders, PDF tools) that may delay malicious behaviour to evade detection.
• Review session-token handling: Ensure critical financial applications invalidate sessions on credential reset and enforce re-authentication. Browser extension credential theft often captures session cookies that remain valid after password changes.

5. Indicators of compromise

No indicators of compromise available in the source material. The source references a Microsoft-published PDF containing the full list of 119 malicious extension names, but this content was not included in the provided material. No file hashes, domains, IP addresses, or other atomic IOCs are present in the sources.

6. Detection

Insufficient indicators to author detection rules. The source material does not contain specific file hashes, domains, IP addresses, mutex names, registry keys, command-line strings, or other artefacts suitable for YARA or Sigma rule construction. The Microsoft-published PDF listing the 119 extension names is referenced but not included in the provided sources. If that list becomes available, YARA rules targeting extension manifest names and Sigma rules detecting extension installation events would be actionable.

7. Sources

• Risky Bulletin — "Microsoft disrupts StegoAd operation" — https://news.risky.biz/risky-bulletin-microsoft-disrupts-stegoad-operation/ — 2026-06-29
• The Hacker News — "Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts" — https://thehackernews.com/2026/06/microsoft-removes-119-edge-extensions.html — 2026-06-29

8. Adverse Trace position

This is a medium-severity item for EMEA financial services. No CVE, CVSS score, or CISA-KEV entry applies. The core risk to clients is credential and session-token theft via browser extensions installed by staff on work or personal browsers used for business purposes. The three-to-five-day activation delay and steganographic C2 demonstrate a capable actor with mature evasion tradecraft, but the attack requires the user to voluntarily install an extension — it is not a remote-exp exploitable vulnerability. Attribution to "StegoAd" is unconfirmed (no MITRE ATT&CK profile). The 2.6M-user figure is single-sourced and unprecise. We will monitor for release of the Microsoft PDF containing the 119 extension names and update IOCs and detection rules when that list becomes available. Clients should immediately audit browser extension inventories and implement allow-listing as a standing control.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.