GhostPoster campaign shows browser extensions can hide malware

At a glance

What this is: NHI Mgmt Group's analysis, drawing on LayerX Security's blog post: GhostPoster browser extension malware used hidden payloads, delayed execution, and store distribution to evade review and persist in the wild.

Why it matters: It matters because browser extensions can become unmanaged software supply chain and identity-adjacent risk channels inside enterprise estates, especially when policy controls do not govern installation, runtime behavior, or persistence after takedown.

By the numbers:

• LayerX Security identified 17 additional extensions associated with the same infrastructure and tactics.
• One variant alone accounted for 3,822 installs.

Context

Browser extensions can behave like ungoverned software running inside a managed browser session. When they can hide payloads in icon files, delay activation, and survive store takedowns, the security problem shifts from simple extension review to lifecycle governance, runtime control, and persistence management.

GhostPoster is a useful case study because it combines concealment, delayed execution, and cross-store reach. For identity and access practitioners, the relevant question is not only what the extension does, but who is allowed to install it, what it can access at runtime, and how long it remains trusted after detection.

The campaign also shows how browser ecosystems can become a policy gap when extensions are treated as low-risk productivity add-ons rather than executable code with data access and network reach. That is a typical blind spot in browser governance, not an edge case.

Key questions

Q: What breaks when a browser extension hides malware inside packaged assets?

A: Static review breaks first, because the malicious code is not obvious in manifest files or visible scripts. When a browser extension hides payloads inside images or other bundled assets, security teams need analysis that inspects archive contents, runtime extraction behavior, and post-install network activity, not just store metadata or developer declarations.

Q: Why does delayed execution make malicious browser extensions harder to catch?

A: Delayed execution breaks the assumption that malicious behavior will appear during installation or initial sandboxing. A dormant extension can look benign long enough to pass review, then activate later when monitoring has ended. That means time-limited checks are inadequate if the extension can wait hours or days before contacting infrastructure.

Q: What are the signs that a browser extension is behaving more like malware than a legitimate productivity tool?

A: Warning signs include invisible background operation, excessive permissions, search redirection, and inability to uninstall the extension cleanly. A second red flag is an associated helper app or uninstaller that asks for more trust than the extension itself. When an extension’s removal path creates pressure to run extra software, security teams should assume the package deserves deeper review.

Q: How should organisations respond when a malicious extension is removed from the store but remains installed?

A: They should treat the marketplace removal as only one step and verify endpoint removal across the managed browser estate. The practical issue is persistence on user devices, so security teams need inventory, revocation, and confirmation that the extension is no longer active in any browser profile.

Technical breakdown

How GhostPoster hides its payload inside a browser extension

GhostPoster uses steganography, which means the malicious payload is concealed inside apparently normal data rather than delivered as an obvious script. In this campaign, the loader is embedded in a PNG icon file or staged through an image bundled with the extension, then extracted at runtime by extension logic. That defeats simple static review because the suspicious content is not present as a readable script until the extension parses it. The result is a supply-chain style delivery path inside an app-like package that most users and many controls trust implicitly.

Practical implication: browser extension review must inspect packaged assets and runtime extraction behavior, not just manifest declarations and visible script files.

Why delayed activation weakens detection and response

Delayed activation is a common evasion pattern because it separates installation from malicious behavior. GhostPoster waits 48 hours or more, and one variant sleeps for about five days before contacting infrastructure or executing the next stage. That reduces the chance that sandboxing, user observation, or quick post-install checks will see the malicious behavior. It also helps the extension survive store takedown events, because the installed copy can remain dormant until the detection window has passed. The technical point is that time is part of the evasion strategy, not just a byproduct of execution planning.

Practical implication: behaviour monitoring must extend well beyond installation time and should detect delayed network activity and scheduled execution drift.

How browser extension persistence and C2 staging extend compromise

Once activated, GhostPoster retrieves secondary payloads from command-and-control infrastructure and stores decoded content locally for later reuse. That creates a modular chain where each stage can be swapped or updated without reinstalling the extension. The campaign also manipulates HTTP headers and injects scripts and iframes, which expands the extension from a hidden loader into a web traffic and page-content control point. In practical terms, this is not just malware in a browser add-on. It is persistent runtime authority inside a user session with the ability to alter what the browser sends, receives, and renders.

Practical implication: defenders need runtime controls that can detect unauthorized network calls, DOM manipulation, and post-install payload staging inside extensions.

Threat narrative

Attacker objective: The attacker objective is to maintain long-lived browser-level control for monetisation, tracking, and downstream payload delivery without triggering routine extension review.

1. Entry occurs when a user installs a browser extension that appears legitimate but carries a hidden payload inside its icon or bundled image assets.
2. The extension extracts the concealed loader at runtime and delays execution for hours or days, which helps it avoid immediate inspection and user suspicion.
3. After activation, the extension contacts remote C2 infrastructure, downloads additional JavaScript payloads, and persists locally for continued control and updating.
4. Impact includes header stripping, script injection, affiliate hijacking, tracking, and click-fraud activity across affected browsers.

Breaches seen in the wild

• Secrets in VS Code extensions 2025: Wiz found 550+ secrets in VS Code extensions, including publishing tokens able to push malicious updates to about 150,000 installs.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser extensions have become a governance surface, not a convenience layer: GhostPoster shows that a browser add-on can carry executable behavior, network reach, and persistence even when it looks like a productivity tool. That changes how organisations should classify extensions in the identity and control stack. The practical conclusion is that extension approval must be treated as software trust governance, not desktop housekeeping.

Delayed activation is an identity and control blind spot: Security programmes often assume malicious behavior will appear quickly enough to be caught by install-time review or short-lived sandboxing. GhostPoster breaks that assumption by waiting days before acting, which means the control failure is not just detection quality but timing. The practical conclusion is that runtime observation windows must extend beyond initial installation and policy checks.

Hidden payload staging creates extension lineage risk: The same infrastructure was linked to multiple extensions and multiple browsers, which means the threat is not a one-off malicious file but a repeatable distribution pattern. That is a supply-chain style problem that sits between browser policy, endpoint control, and software provenance. The practical conclusion is that organisations need to govern extension lineage, not just individual extension names.

Extension persistence outlives store takedowns: Once a malicious extension is installed, removal from a store does not automatically revoke it from endpoints already carrying it. That means the authoritative control point is the managed browser estate, not the public marketplace. The practical conclusion is that offboarding browser extensions must be treated as a lifecycle task, with revocation and verification at the endpoint level.

Policy gaps become attack paths when browsers are treated as low-risk tools: GhostPoster’s mix of obfuscation, runtime extraction, and traffic manipulation shows that browser extensions can operate as invisible intermediaries between users and web services. For identity teams, that is a reminder that session trust is only as strong as the software allowed to sit inside the session. The practical conclusion is that browser governance belongs in the same risk conversation as privileged access and application trust.

What this signals

Browser extension governance now belongs in identity and access programmes: Extensions can read, modify, and exfiltrate session data inside the browser context, which means they operate with borrowed trust from the user and the organisation. The practical boundary is not whether the extension came from a store, but whether it should be allowed to participate in a managed session at all.

Extension lineage is the named concept practitioners should track: When the same loader pattern, infrastructure, and obfuscation method appears across multiple extensions, the risk is no longer a single bad package but a repeatable distribution lineage. That calls for estate-wide revocation logic, not case-by-case cleanup.

Browser controls need the same lifecycle discipline used for other high-trust software channels. If an extension can persist after store takedown, then the real control point is install approval, runtime monitoring, and enforced removal from endpoints.

For practitioners

• Audit managed browser extension estates Inventory every approved and unapproved extension in managed browsers, including extensions installed outside policy controls and those inherited from user installs. Map the publisher, version, store source, install age, and permissions to identify extensions that deserve immediate review.
• Inspect packaged assets for hidden loaders Review extension bundles for image files, obfuscated blobs, and runtime extraction logic that can conceal payloads from routine static checks. Pay special attention to extensions that parse binary data from PNG or other bundled assets at startup.
• Extend monitoring beyond install time Detect delayed network calls, DOM manipulation, header modification, and script injection hours or days after installation. The monitoring window must outlast the initial trust decision or dormant malware will look clean during review.
• Revoke and verify removed extensions Treat store takedown as insufficient on its own and verify that already-installed copies are removed from endpoints. Confirm removal through endpoint or browser management rather than assuming marketplace deletion has ended exposure.
• Tighten extension approval based on runtime authority Approve extensions based on the data they can access and the network actions they can perform, not just on user demand or productivity value. Extensions with page scripting, content injection, or header control should carry explicit governance review.

Key takeaways

• GhostPoster shows that browser extensions can carry concealed malware and still pass through ordinary review paths, which makes them a governance issue as well as a technical one.
• The campaign spread across multiple extensions and browsers, with more than 840,000 installs and long-lived persistence, which explains why store takedown alone is not enough.
• The control gap is not just detection at install time, but runtime monitoring, estate-wide inventory, and enforced removal from managed browsers.

Key terms

• Browser Extension Malware: Browser extension malware is malicious code packaged as an add-on that inherits the browser’s trust and permissions. In practice, it can read pages, alter notifications, redirect traffic, and act on authenticated sessions, which makes webmail and other browser-based services especially exposed.
• Steganographic Payload Delivery: Steganographic payload delivery hides executable data inside apparently harmless files such as images or icons. Security tooling may miss the threat because the malicious content is not obvious until the file is parsed at runtime and decoded into code.
• Delayed activation: Delayed activation is a persistence technique where malware or implants remain dormant before communicating or executing later. It helps attackers outlast incident response, evade quick cleanup, and reappear after defenders believe the environment has been cleared.
• Technical Lineage: The recorded path that shows where data came from, how it changed, and where it is used. For AI governance, lineage is the evidence trail that helps teams verify whether a model or agent is operating on current and traceable inputs.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.