Attackers use browser extensions to intercept credentials, session tokens, and sensitive data as they move through the browser. The extension looks legitimate. The damage happens silently, on every page the user visits.
Most malicious extensions start life as legitimate ones. Attackers acquire widely installed extensions, wait for install counts to reach scale, then push a malicious update. Every browser running the extension updates automatically.
These attacks are prominent and impactful. The most notable example is the Cyberhaven breach. A developer was phished via a consent phishing lure from a legitimate Google domain, giving the attacker access to the Chrome Web Store. A malicious update was uploaded, and 2.6 million users were infected across a month-long campaign, with credentials, session tokens, and payment details harvested from visited pages.
Malicious extensions are designed to evade static and dynamic analysis. Many load their payloads dynamically from a remote server, so the extension code itself contains nothing obviously malicious at the time of review. The GhostPoster campaign, 890,000 installs across 34 extensions, evaded detection by waiting 48 hours between check-ins and loading a payload only 10% of the time.
By the time malicious behavior is observed, the extension is already running in production browsers across the environment. Endpoint tools see browser processes. They don't see what extensions are executing inside them. That’s why the browser is the new battleground.
Push gives security teams visibility into every extension running across the environment, including what permissions each extension holds and where it was installed from. Known malicious extensions are blocked from running. Risky extensions can be flagged or removed without requiring device management or user intervention.
Because Push operates inside the browser, it detects extension behavior as it happens, not after a file lands on disk or an alert fires downstream. For attacks that live entirely within the browser session, that's the only detection point that matters.
