The most popular malicious extension, dubbed Google Translate in Right Click, was downloaded more than 500,000 times from app stores. Another, Translate Selected Text with Google, racked up almost 160,000 downloads.<\/b>
\nIf you\u2019ve been using browser extensions to download YouTube videos or images from Pinterest, translate text in real time, check Amazon price histories, or even enhance colors, you might have some uninstalling to do.
Cybersecurity firm LayerX has uncovered 17 malicious browser extensions that were downloaded more than 840,000 times in total, with some remaining active in the wild for up to five years. Instances were recorded across Firefox, Google Chrome, and Microsoft Edge browsers.
Mozilla and Microsoft have removed all of the extensions from their official stores at the time of writing. However, if you\u2019ve already installed one, you\u2019ll need to uninstall it manually.
The most popular malicious extension, dubbed \u201cGoogle Translate in Right Click,\u201d was downloaded more than 500,000 times from app stores. Another, \u201cTranslate Selected Text with Google,\u201d racked up almost 160,000 downloads.
The extensions were part of a malware campaign researchers named GhostPoster, identified by Koi Security last month. The browser-based malware used \u201csteganography\u201d\u2014hidden links or code embedded inside images\u2014to infiltrate users\u2019 machines.
The extensions also relied on a technique known as delayed execution, meaning it could take weeks or even months before their malicious behavior was triggered. Once activated, the extensions were capable of stripping and injecting HTTP headers to weaken web security policies, hijacking affiliate traffic for monetization, and injecting scripts to enable click fraud and user tracking.
In addition, the extensions could perform automated CAPTCHA solving and inject additional malicious scripts, giving attackers extended control over infected browsers.
The extensions were named: Google Translate in Right Click, Translate Selected Text with Google, One Key Translate, Translate Selected Text with Right Click, Ads Block Ultimate, AdBlocker, Amazon Price History, Color Enhancer, Cool Cursor, Convert Everything, RSS Feed, and Floating Player \u2013 PiP Mode.
Others listed include: YouTube Download, Instagram Downloader, Save Image to Pinterest on Right Click, Full Page Screenshot, Page Screenshot Clipper, and Youtube Download.
But these aren\u2019t the only extensions you need to worry about. Koi\u2019s earlier investigation unveiled numerous other malicious browser extensions, including the popular Urban VPN Proxy, a Google Chrome extension with 8 million users that was secretly collecting data from conversations with AI tools like ChatGPT, Claude, and Gemini to sell to data brokers.
The illicit VPN used the same strategy of hiding code inside a PNG image before redirecting the user to a website primed to inject malware.
If one of the extensions above looks familiar, check out PCMag\u2019s guide to removing browser extensions from most major browsers.<\/p>\n