Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts

Microsoft removed 119 StegoAd Edge extensions that hid payloads in image and font files to steal credentials and run ad fraud.

Microsoft removed 119 malicious Edge extensions that hid payloads in image and font files to steal credentials and run ad fraud. The extensions, known as StegoAd, were able to evade detection by concealing their malicious code within ordinary image and font files. This tactic allowed them to remain dormant for days after installation before activating and beginning their malicious activities. The operation was shut down by Microsoft after it was discovered.

The removal of these extensions directly affects users of the Edge browser who may have inadvertently installed the malicious software, potentially putting their personal credentials at risk. This incident highlights the importance of carefully vetting extensions before installation. Users who have installed these extensions may have already had their credentials stolen, and should take immediate action to change their passwords. This could also lead to financial losses for individuals whose credentials were stolen.

The StegoAd operation is part of a larger trend of malicious actors using stealthy tactics to evade detection and compromise user systems. Insiders are aware that the use of steganography, or hiding data within other files, is a growing tactic among malicious actors. This incident is significant because it demonstrates the evolving nature of cyber threats and the need for continuous vigilance in detecting and removing malicious software. Microsoft's actions to remove the extensions demonstrate the company's efforts to protect its users.

In the coming weeks, Microsoft is expected to release further guidance on how to identify and remove any remaining malicious extensions. The company will also be working to improve its detection and removal processes to prevent similar incidents in the future. A report on the incident is expected to be released by the end of the quarter, which will provide more details on the scope and impact of the StegoAd operation. The fact that the malicious code was able to remain dormant for days after installation highlights the sophistication of the attackers and the need for more advanced detection methods.