Malicious Browser Extension Scams
Fake or hijacked browser extensions that steal passwords, inject ads, and monitor everything you type.
Last reviewed: 1 June 2026
What this scam is
Malicious browser extension scams distribute browser add-ons — for Chrome, Firefox, Edge, or other browsers — that are designed to steal credentials, intercept financial data, inject fraudulent advertisements, redirect you to phishing pages, or monitor everything you type in the browser. The extensions may be entirely fake from the outset, or they may begin as legitimate tools that are later updated with malicious functionality after they have accumulated a large user base.
Browser extensions are a powerful attack vector because they are granted deep access to browser activity by design. A legitimate extension that helps you save passwords, block ads, or enhance shopping needs to read the content of web pages you visit, interact with form fields, and sometimes communicate with external servers. A malicious extension uses exactly the same permissions for surveillance and theft.
The extensions arrive through several routes. Some are distributed in unofficial ways — through pop-ups, scam emails, or links in messages — claiming to offer useful tools like a free VPN, an ad blocker, a streaming unlocker, or a productivity helper. Others appear in the official browser extension stores, passing initial review but later updated to include malicious code. Others are created specifically to impersonate popular legitimate extensions, with near-identical names and icons to confuse users into installing the wrong one.
Once installed, an extension with broad permissions can read and modify the content of every page you visit. This allows it to harvest login credentials typed into any site, capture payment card details as you type them into checkout pages, inject fraudulent advertisements or affiliate links into shopping sites, redirect searches and links to scam or advertising sites, and silently communicate your activity to an external server.
How it works
The distribution route sets the stage for installation. A pop-up or message claims you need a specific extension to watch a video, access a free tool, enhance your browsing speed, or protect your privacy. The link does not lead to the official extension store — it leads to a direct installation prompt hosted on an external site, where you are asked to click 'Add to browser'. Some malicious extensions do appear in official stores and are installed through normal store pages, making them harder to identify.
Once installed, the extension requests permissions during setup. These are displayed in a list before you confirm the installation. Common permissions include 'Read and change all data on websites you visit', 'Access browsing history', and 'Communicate with cooperating websites'. These permissions are also required by many legitimate extensions, so their presence alone does not indicate malice — but their scope warrants scrutiny.
With broad permissions active, the extension operates silently in the background on every page you visit. It may inject a small script that waits for login form submissions, capturing username and password fields as you type and before you click submit. On payment pages, it may capture card details. On banking sites, it may intercept transaction data or inject fake fields requesting additional verification.
Legitimate extensions that are later compromised represent a distinct risk. An attacker may purchase an extension from its developer, then push a malicious update to all existing users — who trust the extension because it previously behaved correctly. The update may request additional permissions, which users may approve without scrutiny.
Why this scam works
The attack exploits the elevated trust users place in software they have already installed and found useful. An extension that has been running harmlessly for months is not something most users monitor actively. A malicious update can deploy silently without triggering any visible change in behaviour. The permissions model of browser extensions is also opaque to most users — the difference between 'read data on active tab' and 'read and change all data on all websites' is significant but rarely understood.
A typical pattern
A person searching for a free productivity tool clicks a link in a search result leading to a website promoting a browser extension. The site looks professional. They click 'Add to Browser' and the extension installs. The extension appears to provide the advertised function and operates normally for several weeks. During this time, it silently captures credentials from every login page the person visits, including their online banking. Several weeks after installation, their bank account shows a login from an unrecognised location and a pending transfer they did not authorise.
Common red flags
- Extension recommended via a pop-up, email, or link rather than found independently
- Extension requesting 'read and change all data on all websites' for a simple function
- Developer name or website slightly different from a well-known extension
- Extension that is a near-copy of a popular tool with similar name and icon
- Extension installed from a site other than the official browser extension store
- Permission requests that seem disproportionate to the extension's stated function
- Unusual browser behaviour after installing a new extension
- Extension with very few reviews or recent negative reviews mentioning account issues
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Install our free VPN extension to unblock any site instantly: [fake link].
Enhance your browser with our productivity suite — add it now for free: [fake link].
This page requires an extension to view. Click here to install it: [fake link].
Get the best deals automatically with our shopping assistant extension: [fake link].
Install our security checker extension to browse safely: [fake link].
Your browser is missing a plugin needed to watch this video. Install here: [fake link].
Common variations
- Fake free VPN extension — offers free VPN service while harvesting credentials
- Fake ad blocker — impersonates a popular ad blocker to gain broad page access
- Shopping coupon injector — injects affiliate links and captures card details
- Compromised legitimate extension — previously safe extension sold to a bad actor and updated
- Search hijacker — redirects searches and homepage to scam or advertising sites
- Credential harvester — silently captures form fields on every login page visited
How to verify before you act
Install browser extensions only from the official extension store for your browser and only from verified developers. Check the developer's name and website carefully — a slight variation in spelling or an unfamiliar domain is a warning sign.
Before installing, review the permissions the extension requests. If an extension offering a simple service — a colour picker, a word counter, a timer — requests access to read and change all data on all websites, the scope is disproportionate and suspicious.
Periodically audit the extensions you have installed. Remove any you no longer use or do not remember installing. For extensions you rely on, check whether there have been any ownership changes or reports of malicious behaviour in recent reviews.
Avoid installing extensions at the suggestion of a pop-up, email, or link in a message. Navigate to the extension store directly and search for the tool by name.
Payment methods used
- Harvested credentials used for banking access and financial theft
- Captured card details used for fraudulent transactions
Who is usually targeted
- Anyone who uses browser extensions
- People seeking free productivity, privacy, or media tools
- Users of online banking and shopping on the affected browser
What to do immediately
- Disable or remove the suspicious extension from your browser immediately
- Change passwords for any accounts you logged into while the extension was active
- Check banking and financial accounts for unauthorised activity
- Review and revoke active sessions on important accounts
- Run a security scan to check for any additional malware installed via the extension
- Review your full list of installed extensions and remove any you do not recognise or need
- Enable two-factor authentication on accounts that may have been exposed
How to prevent it
- Install extensions only from the official store, not from links or pop-ups
- Check the developer name and reputation before installing any extension
- Review permissions before accepting — reject disproportionate requests
- Keep your extension list minimal — uninstall anything you no longer actively use
- Check extension reviews and news periodically for reports of malicious updates
- Be sceptical of extensions offering free versions of paid services (VPNs, security tools)
- Consider using a separate browser profile with no extensions for online banking
- Enable automatic updates for your browser so security patches apply quickly
Evidence to preserve
- Name and developer of the extension
- The source (link, pop-up, or store page) through which you installed it
- Date of installation
- Permissions the extension held
- Account activity logs showing suspicious access
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
Can extensions in the official store be malicious?
Yes. Some malicious extensions pass initial review. Others begin as legitimate tools and are later updated with malicious code after the developer sells the extension or is compromised. The official store reduces but does not eliminate risk.
Why do extensions need such broad permissions?
Some legitimate extensions genuinely need access to all pages — ad blockers and password managers, for example. The question is whether the scope of permissions matches the function. A colour picker needing access to all websites is disproportionate; a password manager needing it is more understandable.
I removed a suspicious extension — are my accounts still at risk?
The extension is no longer active, but any credentials it already captured may still be in the attacker's possession. Change passwords for accounts you logged into while the extension was active, and review account activity.
How do I audit my browser extensions?
In Chrome, go to the menu > More Tools > Extensions. In Firefox, go to the menu > Add-ons and themes. Review each entry: if you do not recognise it, did not install it deliberately, or no longer use it, disable and remove it.
Is it safe to use free VPN browser extensions?
Many free VPN extensions monetise by collecting and selling browsing data, even if they are not outright malicious. Some are deliberately malicious from the outset. Paid, reputable VPN services are a safer choice if privacy is the goal.
Can an extension affect my banking even if I use HTTPS?
Yes. An extension with page-modification permissions can read the content of a page after it has been decrypted and displayed in your browser — including what you type into form fields. HTTPS protects traffic in transit, not from software running inside the browser.
What should I do if I notice my browser redirecting searches unexpectedly?
This is a classic sign of a search-hijacking extension or malware. Go to your extension list and remove anything unfamiliar. Check your browser's default search engine setting and reset it. Run a security scan.