GhostPoster Malicious Browser Extensions: The Silent Spies Watching You for 5 Years

They've been watching you for five years, and you likely never noticed. According to reports from Lifehacker and cybersecurity firms, researchers have identified a massive malware campaign involving 34 dangerous extensions across Google Chrome, Firefox, and Edge.

The GhostPoster Malicious Browser Extensions Campaign Uncovered

Cybersecurity researchers at LayerX and Koi Security revealed that these malware-infected add-ons are part of the 'GhostPoster' campaign. First identified in late 2025, the malware hides its payload within the extension's PNG logo, allowing it to evade traditional security detection for years.

The threat is far from minor. These extensions monitor your browsing history, strip away security protections, and can even execute remote code on your device. One particularly popular extension, 'Google Translate in Right Click,' reportedly garnered over 500,000 installs before being flagged.

High-Risk Extensions You Must Delete Manually

While these extensions have been removed from official web stores, they remain active on your computer if previously installed. The list includes everyday tools like Ads Block Ultimate, Youtube Download, Instagram Downloader, and Amazon Price History. Experts urge users to check their extension settings immediately and remove any matching names to prevent further data theft or system compromise.