A new malware campaign is targeting Google Chrome and Microsoft Edge users by force-installing malicious browser extensions. The malware bypasses traditional security checks and user prompts by utilizing Windows registry keys, specifically the ExtensionInstallForcelist policy. This technique is typically reserved for enterprise administrators, allowing the malware to gain persistent access to the browser without the user's knowledge or consent.
Once installed, these malicious extensions can perform a variety of harmful actions, including stealing sensitive information, hijacking sessions, and injecting unwanted advertisements. Because the extensions are installed via system policies, users often find it impossible to remove them through standard browser settings. This highlights the evolving sophistication of browser-based threats and the need for robust endpoint protection.
