DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide
DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide
31 December 2025
The threat actor behind two malicious browser extension campaigns, ShadyPanda and GhostPoster, has been attributed to a third attack campaign codenamed DarkSpectre that has impacted 2.2 million users of Google Chrome, Microsoft Edge, and Mozilla Firefox.
The activity is assessed to be the work of a Chinese threat actor that Koi Security is tracking under the moniker DarkSpectre. In all, the