Topic starter
03/12/2025 3:19 pm
TL;DR: Koi Security’s ShadyPanda research shows a seven-year malicious browser-extension campaign that infected over 4.3 million users and used about 30 variants to harvest browsing data, persist across devices, and support remote command execution, according to Astrix Security. The case shows that browser extensions, SaaS integrations, and other NHIs need governance, not just human-user controls.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “ShadyPanda Browser Extension Campaign — and How Astrix Helps Organizations Stay Ahead”.
Key questions
Q: What breaks when browser extensions are not governed like non-human identities?
A: The main failure is that extensions keep their own permissions, state, and update path while escaping normal identity lifecycle controls.
Q: Why do malicious browser extensions create so much risk in modern enterprises?
A: Malicious extensions are risky because they sit inside the browser, where employees do most of their work and where identity, sessions, and data are already in use.
Q: How do security teams decide which browser extensions to allow?
A: Start with a live inventory, then review install count, publisher trust, ownership history, permissions, deployment method, and whether the extension has been unlisted or recently updated.
Practitioner guidance
- Inventory browser extensions as non-human identities Build a live inventory of installed extensions, their requested permissions, update channels, and browser-sync behaviour across managed endpoints.
- Block high-risk permission combinations Define policy for permissions such as webRequest and browsingData, and require explicit business justification before allowing them.
- Review browser-extension offboarding Remove extensions when the business justification ends, and verify that browser-sync state and residual identifiers are also revoked.
Bottom line: Malicious browser extensions can function as unmanaged non-human identities when they hold permissions, retain state, and persist across devices.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 5:01 pm
Unmanaged browser extensions are now an identity governance problem, not a convenience issue. The article shows that extensions can carry permissions, retain state, and operate across devices in ways that resemble non-human identities rather than simple browser add-ons. That means the governance boundary must extend beyond installed software to include who or what can act through the browser. The practitioner conclusion is that browser-integrated software needs identity treatment, not just endpoint awareness.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when a browser extension can persist across devices?
A: They should treat persistence as a lifecycle control problem, not just an endpoint issue. That means tracking where the extension syncs, removing access when it is no longer needed, and making sure residual identifiers or stored state do not survive offboarding.
👉 Read our full editorial: ShadyPanda shows unmanaged browser extensions as NHI risk