Connect with us

Technology

Malicious browser extensions hit 4.3M users

Published

on

Malicious browser extensions hit 4.3M users

NEWYou can now listen to Fox News articles!

A long-running malware campaign quietly evolved over several years and turned trusted Chrome and Edge extensions into spyware. A detailed report from Koi Security reveals that the ShadyPanda operation affected 4.3 million users who downloaded extensions later updated with hidden malicious code.

These extensions began as simple wallpaper or productivity tools that looked harmless. Years later, silent updates added surveillance functions that most users could not detect.

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

THIS CHROME VPN EXTENSION SECRETLY SPIES ON YOU

Advertisement

Malicious extensions spread through trusted browsers and quietly collected user data for years. (Kurt “CyberGuy” Knutsson)

How the ShadyPanda campaign unfolded

The operation included 20 malicious Chrome extensions and 125 on the Microsoft Edge Add-ons store. Many first appeared in 2018 with no obvious warning signs. Five years later, the extensions began receiving staged updates that changed their behavior.

Koi Security found that these updates rolled out through each browser’s trusted auto-update system. Users did not need to click anything. No phishing. No fake alerts. Just quiet version bumps that slowly turned safe extensions into powerful tracking tools.

NEW EMAIL SCAM USES HIDDEN CHARACTERS TO SLIP PAST FILTERS

WeTab functions as a sophisticated surveillance platform disguised as a productivity tool. (Koi)

Advertisement

What the extensions were doing behind the scenes

Once activated, the extensions injected tracking code into real links to earn revenue from user purchases. They also hijacked searches, redirected queries and logged data for sale and manipulation. ShadyPanda gathered an unusually broad range of personal information, including browsing history, search terms, cookies, keystrokes, fingerprint data, local storage, and even mouse movement coordinates. As the extensions gained credibility in the stores, the attackers pushed a backdoor update that allowed hourly remote code execution. That gave them full browser control, letting them monitor websites visited and exfiltrate persistent identifiers.

Researchers also discovered that the extensions could launch adversary-in-the-middle attacks. This allowed credential theft, session hijacking and code injection on any website. If users opened developer tools, the extensions switched into harmless mode to avoid detection. Google removed the malicious extensions from the Chrome Web Store. We reached out to the company, and a spokesperson confirmed that none of the extensions listed are currently live on the platform.

Meanwhile, a Microsoft spokesperson told CyberGuy, “We have removed all the extensions identified as malicious on the Edge Add-on store. When we become aware of instances that violate our policies, we take appropriate action that includes, but is not limited to, the removal of prohibited content or termination of our publishing agreement.” 

Most of you will not need the full technical IDs used in the ShadyPanda campaign. These indicators of compromise are primarily for security researchers and IT teams. Regular users should focus on checking your installed extensions using the steps in the guide below.

You can review the full list of affected Chrome and Edge extensions to see every ID tied to the ShadyPanda campaign by clicking here and scrolling down to the bottom of the page.

Advertisement

How to check whether your browser contains these extension IDs

Here is an easy, step-by-step way for you to verify if any malicious extension IDs are installed.

For Google Chrome

Open Chrome.

Type chrome://extensions into the address bar.

Press Enter.

Look for each extension’s ID.

Advertisement

Click Details under any extension.

Scroll down to the Extension ID section.

Compare the ID with the lists above.

If you find a match, remove the extension immediately.

For Microsoft Edge

Open Edge.

Advertisement

Type edge://extensions into the address bar.

Press Enter.

Click Details under each extension.

Scroll to find the Extension ID.

If an ID appears in the lists, remove the extension and restart the browser.

Advertisement

183 MILLION EMAIL PASSWORDS LEAKED: CHECK YOURS NOW

Simple security steps can block hidden threats and help keep your browsing safer. (Kurt “CyberGuy” Knutsson)

How to protect your browser from malicious extensions

You can take a few quick actions that help lock down your browser and protect your data.

1) Remove suspicious extensions

Before removing anything, check your installed extensions against the IDs listed in the section above. Most of the malicious extensions were wallpaper or productivity tools. Three of the most mentioned are Clean Master, WeTab and Infinity V Plus. If you installed any of these or anything that looks similar, delete them now. 

2) Reset your passwords

These extensions have access to sensitive data. Resetting your passwords protects you from possible misuse. A password manager makes the process easier and creates strong passwords for each account.

Advertisement

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

3) Use a data removal service to reduce tracking

ShadyPanda collected browsing activity, identifiers and behavioral signals that can be matched with data already held by brokers. A data removal service helps you reclaim your privacy by scanning people-search sites and broker databases to locate your exposed information and remove it. This limits how much of your digital footprint can be linked, sold or used for targeted scams.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Advertisement

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

4) Install strong antivirus software

An antivirus may not have caught this specific threat due to the way it operated. Still, it can block other malware, scan for spyware and flag unsafe sites. Many antivirus tools include cloud backup and VPN options to add more protection.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

5) Limit your extensions

Each extension adds risk. Stick with known developers and search for recent reviews. If an extension asks for permissions it should not need, walk away. 

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

ShadyPanda ran for years without raising alarms and proved how creative attackers can be. A trusted extension can shift into spyware through a silent update, which makes it even more important to stay alert to changes in browser behavior. You protect yourself by installing fewer extensions, checking them from time to time and watching for anything that feels out of place. Small steps help lower your exposure and reduce the chances that hidden code can track what you do online.

Have you ever found an extension on your browser that you didn’t remember installing or one that started acting in strange ways?  How did you handle it? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alert, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

Copyright 2025 CyberGuy.com.  All rights reserved.

Advertisement

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

The best AirPods deals you can get right now

Published

on

The best AirPods deals you can get right now

If you know where to look, you can often score deals on Apple’s ever-expanding AirPods lineup. Both the AirPods Pro 3 and the AirPods 4 (with and without ANC) now consistently receive discounts, as do the AirPods Pro 3. And while major shopping events like Black Friday and Amazon Prime Day have delivered some of the biggest price drops, there are still good deals to be found on every model — including the recently released AirPods Max 2.

Below, we’ve rounded up the best deals currently available on each set of AirPods, including both iterations of the AirPods 4 and AirPods Max, as well as the third-gen AirPods Pro.

At the end of 2024, Apple introduced the AirPods 4, a pair of wireless earbuds available in two variations: a $129 standard model and a $179 noise-canceling model. Both versions represent significant upgrades over the third-gen AirPods, with a more comfortable design and improved audio performance. They’re also better for taking calls thanks to Apple’s Voice Isolation feature, which focuses the mics on your voice so you can be heard more clearly in noisy environments.

The $179 AirPods 4 with Active Noise Cancellation offer a surprisingly effective noise-canceling mode, a helpful transparency mode, and several other Pro-level features. The latest AirPods Pro do a better job of tuning out noise, but the AirPods 4 with ANC still do a good job of reducing sound. They also feature other perks formerly reserved for Apple’s top-of-the-line earbuds, including wireless charging and a case with a built-in speaker that allows you to easily track it down via Apple’s Find My app.

Given they’ve been out for over a year, we consistently see discounts for both iterations of the AirPods 4. During Black Friday, we saw the standard model drop to a new low of $74; however, right now, they’re only down to $119 ($10 off) at Amazon, Walmart, and B&H Photo. The AirPods 4 with ANC, meanwhile, are on sale for $154.99 ($24 off) at Amazon, Walmart, and Costco (for members), which is significantly more than their recent low of $99.

Advertisement

The best AirPods Pro 3 deals

At its “Awe Dropping” event in September, Apple introduced the AirPods Pro 3. In addition to improved ANC and sound, the third-gen earbuds include a built-in heart rate sensor that syncs with the iPhone Fitness app, allowing you to track your pulse and calories burned across more than 50 workout types. They’re also more comfortable and secure than their predecessor, thanks to a redesigned, angled fit and five ear tip sizes — including a new XXS option. Additionally, they carry a more robust IP57 rating and support Apple’s new live translation feature, which, in our testing, generally conveys the gist well but still can’t beat a human interpreter.

Given how recently they launched, we’ve been surprised by how often the AirPods Pro 3 have been discounted. In fact, last month we saw them drop to $199 ($50 off), which is $15 shy of their all-time low. Unfortunately, while they’re still on sale, they’ve since increased in price to $224 ($25 off) at retailers like Amazon and Walmart.

The best AirPods Max deals

The AirPods Max aren’t the iconic in-ears that have become synonymous with the AirPods name. Both the first-gen Max and the newer AirPods Max 2 are large and luxurious, comprised of aluminum, steel, and mesh fabric that remains comfortable during extended listening sessions. The original pair delivered clear, expansive sound, great noise cancellation, and lossless audio over USB-C; however, with the Max 2, Apple built upon that excellent foundation with improved ANC and a built-in amplifier for better sound. They also feature Apple’s newer H2 chip, enabling AI-powered live translation, adaptive audio, and other features once reserved for the AirPods Pro line. The over-ears aren’t the best noise-canceling headphones for everyone — blame the sticker price — but for iPhone users, they’re hard to beat.

Advertisement

The AirPods Max 2 retail for $549 — the same price as the original model — but you can currently save $20 on both the black and white versions at Amazon and Costco (if you’re a member), which is the first discount we’ve seen on the recently released headphones. If you’re okay with picking up the last-gen model, the original AirPods Max with USB-C are on sale in select colors for $399.99 ($150 off) at Woot through April 3rd, matching their best price to date. They’re also available in a wider range of hues at Amazon, Walmart, Target, and other retailers for $449.99 ($100 off), which is still a hefty discount.

Update, April 2nd: Updated to reflect current pricing and availability, as well as the recent release of the AirPods Max 2.

Continue Reading

Technology

SSA impersonation scams are getting more personal

Published

on

SSA impersonation scams are getting more personal

NEWYou can now listen to Fox News articles!

The Social Security Administration and its Office of Inspector General issued warnings during their March 2026 “Slam the Scam” campaign, citing the continued volume of impersonation fraud tied to Social Security. Federal data shows these scams remain widespread; more than 330,000 government impersonation complaints were reported to the FTC in 2025. That’s a 25% increase from the year before.

Losses tied to these scams reach into the hundreds of millions of dollars each year, placing them among the most relentless forms of consumer fraud.

These scam messages often resemble official SSA communication, referencing issues with a Social Security number or account records.

Sign up for my FREE CyberGuy Report 

Advertisement

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

TECH GIANTS UNITE TO FIGHT ONLINE SCAMS

Scammers design messages to look like official Social Security alerts, often using familiar details to gain your trust.  (Kurt “CyberGuy” Knutsson)

How do these SSA scams work?

Scammers are using bits of information that feel familiar. A message may include your name, part of your SSN, or even a reference to benefits. Caller IDs can seem to match government offices, and emails or texts may follow the same format used in official SSA communication.

Much of this information comes from data that has already been part of data breaches. When those details show up in a message, the claim sounds consistent with what you already know about your own records.

Advertisement

Earlier this year, there were reports of scam emails that looked like official Social Security messages, asking people to download their Social Security statement through links that led to fraudulent sites. These emails are not from the SSA and will steal your personal information and likely hack your phone or computer once you allow access.

A message that lines up with recognizable information is less likely to be ignored. It moves the conversation forward faster and brings your guard down.

What scammers want when they contact you

At the point of contact, they are trying to get one of two things:

1) Your personal identifiers

They ask for this information under the guise of verifying your identity or resolving an issue with your account.

2) Your money

  • Direct payments (wire transfer, gift cards, crypto)
  • Access to bank or retirement accounts
  • Instructions to “move money to protect it”

This usually comes after they earn your trust or create urgency.

FAKE GOOGLE SECURITY PAGE CAN TURN YOUR BROWSER INTO A SPYING TOOL

Advertisement

Once scammers have your information, they can pass identity checks and open or access financial accounts in your name. (Kurt “CyberGuy” Knutsson)

What scammers do with the information

Once scammers have your information, they move quickly to turn it into access, money and long-term identity fraud.

They use it to get past identity checks

Your SSN, date of birth, and address are often enough to get through basic verification systems. That allows scammers to present themselves as you when applying for credit or contacting financial institutions.

They open or access financial accounts

Once through those checks, they can apply for credit in your name, leading to new accounts, hard inquiries, and balances showing up on your credit report. If login details or verification codes were shared, existing accounts can also be accessed.

They go after benefit-related accounts

The same information can be used to access or make changes to Social Security-related records. This can include attempts to redirect payments by updating direct deposit details.

Advertisement

They continue using the data

Any stolen information can be reused or combined with made-up details to create additional identities, which can then be used to open more accounts over time.

What the SSA will not do

The SSA does not contact individuals out of the blue to request personal information.

It does not ask for full SSNs, bank details, or login credentials over phone calls, text messages, or email.

It also does not demand payment to resolve issues tied to your SSN or benefits.

Requests to transfer money, purchase gift cards, or move funds to keep your accounts safe are not part of any SSA process.

Advertisement

Threats are another warning sign. The agency does not suspend SSNs or issue arrest warnings.

Legitimate communication from the SSA happens through mailed notices or through your My Social Security account. 

The agency states it may send emails in limited cases, such as account notifications, but these do not ask for personal information.  

SSA emails will direct you to log in through SSA.gov rather than asking you to click on links or download attachments.

PHISHING SCAM EXPLOITS APPLE MAIL ‘TRUSTED SENDER’ LABEL

Advertisement

Stolen data can also be used to target your Social Security benefits, including attempts to redirect payments. (Kurt “CyberGuy” Knutsson)

What to do if you receive or respond to one of these messages

If you get a message claiming to be from the SSA, don’t respond and don’t click any links. Don’t call the number in the message.

  • Instead, go to SSA.gov or use a verified phone number to check if there’s actually an issue with your account.
  • If you have already shared information, stop contact immediately and take note of what you shared. You can report the scam to the SSA Office of Inspector General at oig.ssa.gov/report
  • You can also file a report at IdentityTheft.gov, which helps create a record.
  • To limit further misuse, place a fraud alert or credit freeze with Equifax, Experian, and TransUnion, and check your credit reports for any unfamiliar activity.

How to protect yourself

Stolen information is not always used right away. In many cases, identity theft like this is not apparent until it shows up on a credit report or a lender flags it. Monitoring tools can track this type of activity as it happens. Alerts tied to changes in your credit file or exposed personal data can show you where your information is being used.

Many identity protection services monitor credit across the three major bureaus and scan for exposed personal data, including Social Security numbers. They can alert you to new inquiries or accounts and offer support if something looks suspicious.

Some services also scan dark web marketplaces and data leaks to see if your information is being shared or sold. Starting with a free identity breach scan can help you understand your risk and take action early.

If identity theft does happen, these services often provide fraud resolution support. This can include help to contact creditors, placing fraud alerts, disputing unauthorized accounts and preparing documentation to recover your identity. Some plans also include identity theft insurance to help cover eligible recovery costs.

Advertisement

No service can prevent every type of identity theft. However, early alerts and guided support can make a major difference in how quickly you catch and recover from fraud.

How to check if your personal information was exposed

If you are unsure whether your information has already been exposed, take action now. Start with a free identity breach scan to see if your data appears in known leaks. Catching it early gives you more control and helps limit the damage before it spreads.

See my tips and best picks on Best Identity Theft Protection at Cyberguy.com

Kurt’s key takeaways

SSA impersonation scams are not new, but they are getting more convincing. When a message includes details that match your life, it feels legitimate. That is exactly what scammers are counting on. The key is to slow down and verify everything through official channels. The SSA is not going to text you out of the blue, demand money or ask for sensitive details. If a message pushes you to act quickly, that is your signal to pause. Staying ahead of these scams comes down to awareness and simple habits. Verify first. Protect your data. And assume that any unexpected message about your Social Security number deserves a second look.

Have you ever received a message that looked like it came from Social Security, and what made you trust it or question it? Let us know by writing to us at Cyberguy.com

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report 

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com –  trusted by millions who watch CyberGuy on TV daily. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com. All rights reserved.

Advertisement
Continue Reading

Technology

Trump’s birthright citizenship ban may fail — but the administration already got too far

Published

on

Trump’s birthright citizenship ban may fail — but the administration already got too far

On Wednesday morning, the Supreme Court heard arguments in Trump v. Barbara, a case challenging President Donald Trump’s 2025 executive order banning birthright citizenship. Justices seemed skeptical of the administration’s argument, but by taking up birthright citizenship at all, they showed how much ground nativists have gained since Trump’s first term. The 14th Amendment is quite clear: “all persons born or naturalized in the United States, and subject to the jurisdiction thereof, are citizens of the United States and of the State wherein they reside.” Trump seeks to overturn this and create a new, effectively stateless American underclass, and he’s gotten alarmingly far.

Hours after being sworn back into office for his second term, Trump issued an executive order titled “Protecting the Meaning and Value of American Citizenship.” Under the order, children born to undocumented mothers — or to women in the country on non-immigrant visas — would no longer be citizens upon birth, unless the children’s fathers were citizens or permanent residents. The order’s provisions would take effect 30 days after it was issued. It was immediately challenged in court and several federal injunctions prevented its implementation, meaning birthright citizenship remains the law of the land for now.

Trump’s efforts hinge on the meaning of a specific clause: “subject to the jurisdiction thereof.” The administration contends that noncitizens and those who don’t have permanent residency are not subject to the jurisdiction of the United States, since they’re actually loyal to a foreign power. This interpretation would reverse not only centuries of US law but also precedent set by English common law, leaving hundreds of thousands of children without status or stateless upon birth. Karen Tumlin, the director of the Justice Action Center, called the case a “canary in the coalmine for our democracy”: if Trump can end birthright citizenship with the stroke of a pen, then no constitutional protection is safe.

All but the most conservative justices seemed unconvinced. Their questions largely focused on two landmark decisions. One was Dred Scott v. Sandford, the 1857 case in which the court decided that enslaved people were not citizens — which the 14th Amendment was ratified partly to overturn. The other was United States v. Wong Kim Ark, an 1898 case in which the court ruled that, despite the Chinese Exclusion Act, the American-born children of Chinese nationals were indeed US citizens.

After Justice Clarence Thomas asked Sauer how the citizenship clause responds to Dred Scott, Sauer acknowledged that the 1857 decision “imposed one of the worst injustices in the history of this court.” But he argued that Congress specifically ratified the 14th Amendment to grant citizenship to “newly freed slaves and their children” who, according to Sauer, had “a relationship of domicile” to the United States and no “relationship to any foreign power.”

Advertisement

Nineteenth-century legislators, Sauer argued, couldn’t have foreseen the problem of birth tourism. “There are 500 — 500 — birth tourism companies in the People’s Republic of China whose business is to bring people here to give birth and return to that nation,” Sauer said. The current interpretation of birthright citizenship “could not possibly have been approved by the 19th century framers of this amendment,” he said. “We’re in a new world,” he continued, “where 8 billion people are one plane ride away from having a child who’s a US citizen.”

Justice Neil Gorsuch, who was questioning Sauer, appeared unswayed. “It’s a new world,” he agreed, but “it’s the same Constitution.”

“It’s a new world,” Gorsuch said, but “it’s the same Constitution”

Chief Justice John Roberts called Sauer’s examples of existing exceptions — including children of ambassadors or enemies during a hostile invasion — “very quirky” and not necessarily comparable to“a whole class of illegal aliens who are here in the country.” Justice Elena Kagan noted that most of Sauer’s brief focused on people who are temporarily in the country on visas — but Trump’s executive order was clearly intended to restrict immigration, and the president has said so himself.

In 2019, Trump called birthright citizenship a “magnet for illegal immigration.” Last year, presidential adviser Stephen Miller said the US-born children of immigrants are just as much of a problem as the immigrants themselves. “With a lot of these immigrant groups, not only is the first generation unsuccessful,” Miller said in a Fox News interview, citing the Somali-American community, which the administration would soon target in Minneapolis, as an example. “You see persistent issues in every subsequent generation. So you see consistent high rates of welfare use, consistent high rates of criminal activity, consistent failures to assimilate.”

Advertisement

The administration has sought to restrict legal immigration in all its forms: it implemented a steep fee for H-1B work visas, has signaled it may end a work program for international students, and enacted a travel ban on several countries that is even affecting World Cup players. The operation is barefacedly racist. The president famously complained about “all these people from shithole countries” who migrate and expressed his desire to have “more people from Norway.” Last year, he cut the refugee resettlement cap to just 7,500 and prioritized the resettlement of white South Africans. The Department of Homeland Security has linked the “homeland” to a decidedly white vision of Manifest Destiny that, like debates about birthright citizenship, harkens back to the nineteenth century.

Experts are broadly in agreement that most justices weren’t convinced by the administration’s argument, but it’s not clear exactly how the court will rule.

If the court did hand Trump an unexpected victory, a series of grim questions would immediately come into play — starting with when the change kicks in. The order was supposed to be implemented on February 19, 2025, thirty days after Trump signed the order, and would have gone into effect if not for a number of federal injunctions. “If the court sides with Trump, it will have to decide on a date on which to begin applying the president’s interpretation of the 14th amendment,” César Cuauhtémoc García Hernández, a professor of civil rights and civil liberties at the Ohio State University College of Law, told The Verge. “Anyone born on or after that date and described in Trump’s order would be treated as a migrant rather than a U.S. citizen.”

Sauer asked the court to apply Trump’s executive order “proactively” and not retroactively, and backdating the change to 2025 would pose a number of problems, calling the citizenship of millions of children into question.

The Trump administration is trying to narrow who counts as an American while simultaneously pushing for policies that prevent noncitizens from participating in public life. The administration has tried to prohibit states from offering in-state tuition to undocumented immigrants who live there, revoked accreditation for training centers that work with noncitizen truckers, and has broadly sought to turn America into a “papers, please” country.

Advertisement

Trump was in the audience during Wednesday’s arguments, making him the first sitting president to attend oral arguments before the Supreme Court. His presence may have intended to intimidate skeptical justices into taking his side. Norman Wong, a direct descendant of Wong Kim Ark, was also outside the courthouse, according to the New York Times. Wong and his family embody the stakes of this case, and he had a message for the justices: “They will be shamed for history if they get this wrong.”

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Continue Reading

Trending