FlagThis

Abstract

Three browser extension campaigns disclosed in late June 2026 confirm that extensions have become a mature, scalable attack surface capable of reaching enterprise environments. By abusing over-broad permissions and employing advanced evasion techniques—such as steganography and blockchain-based command-and-control—these campaigns facilitate credential theft, session hijacking that bypasses multi-factor authentication, and significant financial loss.