The “GhostPoster” campaign represents a sophisticated abuse of the browser extension supply chain, leveraging steganographic techniques and delayed execution logic to maintain long-term stealth. Researchers at Koi Security identified malicious JavaScript embedded directly within image assets—specifically logo files—used by at least 17 extensions distributed through the Mozilla Firefox add-on ecosystem. These extensions, which accumulated more than 50,000 downloads, were positioned as benign productivity and privacy tools, including VPN clients, ad blockers, weather widgets, translation utilities, and media downloaders.

Steganographic Loader Execution Flow

The attack chain initiates during the normal rendering process of the extension’s logo image. Rather than loading executable code from a conventional script file, the extension parses the image binary and searches for a predefined delimiter string (“===”). Content following this marker is treated as obfuscated JavaScript and dynamically reconstructed at runtime. This technique allows the malicious logic to bypass static code inspection and signature-based detection mechanisms that typically focus on extension scripts and manifests.Once extracted, the loader performs environment checks and initiates outbound communication to attacker-controlled infrastructure, primarily liveupdt[.]com and dealctr[.]com. Network traffic is deliberately throttled: connection attempts occur at 48-hour intervals, and the loader only proceeds with payload retrieval in approximately 10 percent of execution cycles. This probabilistic execution model, combined with a post-installation dormancy period exceeding six days, significantly reduces behavioral indicators during sandboxing and automated review.

Command-and-Control and Payload Delivery

The primary payload is fetched over standard HTTPS, blending malicious traffic with legitimate browser activity. Payloads are custom-encoded rather than using common packers, further complicating automated analysis. Upon successful retrieval, the payload is decrypted and executed in the context of the browser extension, inheriting its permissions and access to web content.

Functional Capabilities and Abuse Scenario

The deployed toolkit focuses on monetization and traffic manipulation rather than immediate data destruction or ransomware-style impact. Key capabilities include:

  • Affiliate Attribution Hijacking: The malware monitors browsing sessions and silently rewrites referral parameters on supported e-commerce platforms, diverting affiliate revenue to attacker-controlled accounts.
  • Tracking and Profiling Injection: Unauthorized insertion of analytics scripts—such as Google Analytics—into visited pages enables persistent user tracking across unrelated websites.
  • Security Control Degradation: By stripping or modifying HTTP response headers like Content-Security-Policy and related protections, the malware increases exposure to secondary attacks, including cross-site scripting and clickjacking.
  • Hidden DOM Manipulation: The payload injects invisible iframes and background elements to generate fraudulent ad impressions and clicks without user interaction.
  • Bot-Detection Evasion: Integrated CAPTCHA bypass techniques allow automated interactions to proceed on sites that would otherwise restrict scripted behavior.

Operational Consistency and Attribution Signals

While individual extensions exhibited minor differences in how the malicious code was embedded within image assets, all samples shared identical runtime behavior, encryption routines, and command-and-control endpoints. This uniformity strongly indicates a single threat actor or coordinated group iteratively testing delivery methods while maintaining a common backend infrastructure.

Broader Threat Context

The GhostPoster campaign aligns with a growing pattern of malicious browser extensions exploiting user trust and platform distribution channels. Recent cases have demonstrated similar abuse, including extensions harvesting sensitive user data and monitoring interactions with AI services such as ChatGPT, Claude, and Gemini, as well as prior incidents involving VPN extensions conducting covert surveillance. Together, these trends underscore the increasing role of browser extensions as a high-value vector for persistent, low-noise compromise.

References