Over a seven-year campaign, the ShadyPanda group has infected 4.3 million users of Chrome and Edge browsers by exploiting trusted browser marketplaces. They initially operated legitimately, building user bases before deploying malicious updates. Koi Security’s report identified a remote code execution backdoor affecting 300,000 users across five (5) extensions, including Clean Master. These extensions functioned normally until mid-2024, when updates began downloading arbitrary JavaScript hourly, logging website visits, and exfiltrating browsing histories. Simultaneously, a spyware operation impacted over 4 million users through five (5) Microsoft Edge extensions, particularly WeTab, which alone accounted for 3 million installs. These extensions collected browsing data and routed it to servers in China. Microsoft removed the malicious extensions following Koi Security’s findings. ShadyPanda’s tactics date back to 2023, launching 145 extensions as wallpaper or productivity tools, injecting affiliate codes, and using Google Analytics for user profiling. Their success was attributed to limited post-approval monitoring, high trust in popular extensions, and long-term legitimacy. As ShadyPanda evolved, they manipulated browsers more aggressively, with extensions like Infinity V+ redirecting searches and harvesting cookies. CTIX Analysts recommend individuals audit and remove unnecessary extensions, preferring those with transparent update histories to defend against similar threats.