7AI Uncovers Browser Extension Campaign Evading EDR Defenses

Why It Matters

Because the attack lives inside legitimate browser processes, most EDR and network tools miss it, leaving organizations exposed to credential theft and data exfiltration. The research forces security teams to rethink extension governance and adopt browser‑centric controls.

Key Takeaways

• 22 malicious Chrome extensions, 85k+ installs, 60+ operator domains
• Extensions strip CSP and X‑Frame‑Options, enabling remote JavaScript execution
• Campaign evades EDR, SSL inspection, DNS filtering, and cloud web gateways
• Attack can harvest Google credentials and conduct ad‑fraud or surveillance
• Featured badge extension shows Chrome Web Store validation weaknesses

Pulse Analysis

The 7AI team’s discovery of the CRXfiltrate operation underscores how browser extensions have evolved from convenient utilities into sophisticated attack platforms. By exploiting Chrome’s declarativeNetRequest API, the malicious extensions silently removed Content‑Security‑Policy and X‑Frame‑Options headers, turning every visited page into a conduit for attacker‑controlled JavaScript. The campaign leveraged a network of 22 extensions, collectively amassing more than 85,000 installations and over 60 operator‑controlled domains. Payloads ranged from ad‑fraud scripts to credential‑harvesting modules that could siphon signed‑in Google accounts, all while remaining invisible to conventional endpoint detection.

Traditional security stacks—endpoint detection and response, SSL inspection, DNS filtering—proved ineffective because the malicious code executed inside the browser’s trusted process. Without dropped files or anomalous processes, alerts were scarce, leaving analysts blind to the intrusion. This visibility gap forces organizations to extend their threat‑model to include browser‑level telemetry, extension inventory, and permission audits. Enterprise policies that whitelist approved extensions, enforce least‑privilege permissions, and integrate with mobile‑device‑management solutions are becoming essential to mitigate this emerging vector.

The rise of cloud‑first workspaces and zero‑trust architectures makes browsers the new perimeter, and attackers are quick to weaponize that shift. As extension marketplaces struggle with validation, security teams must adopt proactive hunting for CSP tampering, unusual outbound traffic, and known indicator sets tied to campaigns like CRXfiltrate. Investing in behavior‑based web‑traffic analysis and sandboxing of extension updates can close the detection gap. Ultimately, a layered approach that blends endpoint, network, and browser controls will be critical to protect enterprise credentials and data from these stealthy, browser‑borne threats.