ShadyPanda

Executive Summary

ShadyPanda is a financially‑motivated threat actor that has conducted a 7‑year supply‑chain campaign infecting more than 4 million Chrome/Edge users through malicious browser extensions. The malware harvests credentials, captures screenshots and exfiltrates data via a range of covert channels while stealthily updating itself and manipulating system settings. Organizations must harden extension management and monitor for silent update activity to mitigate the threat.

Goals & Targeting

The actor’s primary objective is financial gain, achieved through large‑scale data theft of login credentials, payment information, corporate meeting intelligence, and potential espionage assets. By targeting sectors that handle sensitive personal or financial data, ShadyPanda maximizes the commercial value of stolen assets. The campaign’s persistence mechanisms—silent updates, preference file manipulation, and ad‑profile deployment—allow attackers to maintain long‑term access while evading detection.

Key Capabilities

• Silent extension updates via hijacked update URLs
• Injection of malicious JavaScript into browser sessions to redirect searches and alter browsing navigation
• Browser activity monitoring, credential theft (cookies, passwords), screenshot capture
• Installation of RAT/backdoors through malicious extensions
• Manipulation of preference files for silent installation without user consent
• Steganographic embedding of malware code within PNG logos/screenshots
• Exfiltration of data to untrusted domains via browser processes or command‑and‑control channels
• Use of malicious .mobileconfig profiles or plist entries for ad delivery and persistence
• Triggering abnormal child process activity after extension installation

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

ShadyPanda’s operations have unfolded on a consistent, long‑term basis, with periodic bursts of new malicious extensions and updates over seven years. The actor predominantly leverages supply‑chain tactics—primarily through browser update mechanisms—to infect millions of users. Infected victims include employees in finance, government, defense, healthcare, and critical infrastructure, with a geographic focus on the United States, India, Spain, and China. Notable campaign characteristics include silent extension updates that evade user notice, exfiltration to dozens of untrusted domains, the use of steganographic techniques within image files, and the deployment of malicious configuration profiles to establish persistence and broaden reach.

IOC Patterns

• Malicious browser extensions with high‑risk permission patterns
• Hidden JavaScript code embedded in image logos of extensions
• Suspicious update URLs pointing to adversary‑controlled servers
• Manipulated preference or Secure Preferences files for silent installation
• Planted .mobileconfig files used for silent installation
• Abnormal child process activity after extension install

Recommended Actions

• Implement an extension inventory and risk assessment solution (e.g., Zscaler SSPM) to detect non‑approved extensions.
• Enforce whitelisting for all browser extensions and review high‑risk permission requests before approval.
• Monitor for anomalous silent update traffic from extension manifests and block updates that redirect to unfamiliar domains.
• Restrict modification of browser preference files or secure preferences to prevent stealthy installs.
• Disable automatic installation of unknown .mobileconfig profiles or plist entries at the OS level.
• Educate users on phishing and social‑engineering tactics used to lure them into installing malicious extensions.
• Configure group policies to allow only trusted, signed extensions from vetted vendors.
• Shut down browser sessions when idle and enforce multi‑factor authentication to mitigate credential theft.
• Block outbound traffic to known exfiltration endpoints identified in IOC lists.

Suggested Tags