ShadyPanda Browser Extension Campaign — and How Astrix Helps Organizations Stay Ahead

New research from Koi Security has exposed a long-running malicious browser extension operation dubbed “ShadyPanda.” This campaign has quietly persisted for seven years, infecting over 4.3 million users via malicious Google Chrome and Microsoft Edge extensions.

This discovery serves as a stark reminder of the risk posed by unmanaged browser extensions. While often viewed as simple productivity tools, extensions function as powerful integrations with extensive access to sensitive corporate data.

Here is what happened, and how Astrix customers stay protected.

What happened: The ShadyPanda Campaign

The report identifies roughly 30 variants of browser extensions distributed by ShadyPanda. These extensions are often disguised as utility tools such as PDF converters or cleaners, to establish a foothold in affected environments. Once installed, these extensions didn’t just block ads or clear caches; they acted as Remote Code Execution (RCE) backdoors and spyware.

The scope of data exfiltration is alarming. The malicious extensions were designed to harvest:

• Full Browsing Visibility Every URL visited and complete browsing history.
• Navigation Patterns HTTP referrers that show how users move across the web.
• Fingerprinting User agents, screen resolution, timestamps, and platform data.
• Persistent Tracking Perhaps most dangerously, they inject a UUID4 identifier (stored in chrome.storage.sync) that survives across devices and sessions, allowing the actor to build a permanent profile of the user.

These data points enable long-term tracking, profiling, and cross-device persistence. The extensions also functioned as backdoors capable of executing remote commands through malicious C2 infrastructure.

The Enterprise Risk Explained

One of the primary culprits identified in the campaign is an extension titled “Clean Master: the best Chrome Cache Cleaner”.
While the extension claims to optimize browser performance, it actually grants the threat actor “Access to All Resources.”

For an enterprise, this means that if an employee installs this on a work profile, the threat actor potentially gains visibility into internal SaaS platforms, proprietary data, and sensitive workflows.

How Astrix Helps

ShadyPanda is a clear example of why securing integrations and Non-Human Identities (NHIs), not just human users, is critical. Browser extensions, SaaS integrations, and AI agents all behave like entities with permissions. Unmonitored, they create blind spots that attackers exploit. Astrix helps organizations reduce this risk through three core capabilities:

Discovery and Early Detection

Astrix continuously delivers a real-time inventory of all AI Agents and NHIs (service accounts, OAuth apps, API keys, SSH keys, IAM roles, and more), and secrets across cloud, SaaS, and on‑prem environments.

Secure

Visibility is only the first step; context is key. In this specific campaign, Astrix provided the context needed to make a security decision:

• High-Risk Origins: Alerts indicated the supplier origin was a high-risk country (China).
• Over-Privileged Access: The extension requested high-sensitivity permissions (webRequest, browsingData) with zero legitimate business justification.

Armed with this data, Astrix customers were able to remove these integrations proactively, neutralizing the threat before the campaign was publicly attributed to ShadyPanda.

Policy Enforcement

Astrix enables security teams to transition from a reactive to a proactive approach. It enables them to deploy automated policies, such as blocking extensions from untrusted countries or requiring justification for high-sensitivity permissions, to prevent similar threats from entering the environment in the future.

The Bottom Line

Malicious browser extensions are a favored vector for attackers because they sit at the intersection of user trust and high-privilege access.

The Astrix team is here to help. You cannot secure what you cannot see. By monitoring all AI agents and Non-Human Identities with Astrix, organizations gain the visibility and control needed to detect, block, and remove these risks early, before they turn into incidents.If you want help validating extension exposure or reviewing next steps, contact the Astrix team today.