Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts

Microsoft has removed 119 malicious Edge extensions from its store that concealed malware within image and font files. These extensions, linked to a single threat actor, would lie dormant for days after installation before activating to steal credentials and commit ad fraud. The operation, dubbed StegoAd, combines steganography and adware techniques. The threat actor behind StegoAd has been active since at least 2021. Microsoft's action shuts down this long-running malicious operation. The extensions' use of steganography allowed them to hide their true purpose.