Safety Net

Do you have one of these 17 browser extensions? They could be tracking your browsing history.

Cybersecurity researchers identified malware-infected browser extensions on Chrome, Firefox, and Edge browsers.
 By 
Tim Marcin
 on 
safari and chrome apps on phone
Credit: Photo illustration byJakub Porzycki/NurPhoto via Getty Images

You might have a dangerous browser extension monitoring your browser history and not even know it.

As the good folks at Lifehacker reported, cybersecurity researchers with LayerX identified 17 malicious browser extensions across Chrome, Firefox, and Edge, with some active for up to five years. (Disclosure: Lifehacker is owned by Ziff Davis, the same parent company as Mashable.) These malware-infected browser extensions are part of the GhostPoster campaign, first identified in December by Koi Security.

The Koi Security researchers originally identified 17 malicious browser add-ons, for a total of 34 dangerous extensions. The extensions are no longer available, but if you've already downloaded them, they remain active and must be manually deleted as soon as possible.


You May Also Like

As Koi Security found, the extensions hide "a multi-stage malware payload that monitors everything you browse, strips away your browser's security protections, and opens a backdoor for remote code execution." LaxerX further reports that the malware can weaken websites’ security measures, hijack affiliate traffic, inject iframes and scripts that track users, and inject malicious scripts onto a user’s device.

Here's the full list of extensions, via LayerX and Lifehacker:

  • Google Translate in Right Click

  • Translate Selected Text with Google

  • Ads Block Ultimate

  • Floating Player – PiP Mode

  • Convert Everything

  • Youtube Download

  • One Key Translate

  • AdBlocker

  • Save Image to Pinterest on Right Click

  • Instagram Downloader

  • RSS Feed

  • Cool Cursor

  • Full Page Screenshot

  • Amazon Price History

  • Color Enhancer

  • Translate Selected Text with Right Click

  • Page Screenshot Clipper

Some of these were quite popular extensions. Google Translate in Right Click, for instance, had more than half a million installs, according to LayerX researchers.

The malware in the extensions is known as GhostPoster, which hides malicious code in the extension's PNG logo. The researchers say the malware campaign relied on sophisticated methods that let it evade detection for years. So if you've downloaded any of these extensions, it's best to delete them right away.

Read more about the GhostPoster campaign at Lifehacker.

close-up of man's face
Tim Marcin
Associate Editor, Culture

Tim Marcin is an Associate Editor on the culture team at Mashable, where he mostly digs into the weird parts of the internet. You'll also see some coverage of memes, tech, sports, trends, and the occasional hot take. You can find him on Bluesky (sometimes), Instagram (infrequently), or eating Buffalo wings (as often as possible).

Mashable Potato

More from Safety Net
UK government could ban VPNs for children
a woman looking in a lit-up phone screen with a lock next to her

Researchers say they convinced Gemini to leak Google Calendar data (updated)
Google Gemini logo next to a man on a mobile device

Newly discovered malware 'pranks' its victims – just in time for April Fools' Day
Hacker at laptop

Hackers are exploiting a vulnerability in lots of e-commerce sites
Fish-eye lens view of a computer screen with hacking stuff on it


Recommended For You

Google Chrome unveils Gemini-powered auto-browsing feature
Chrome auto browse

Jimmy Kimmel has a brutal response to Pam Bondi tracking lawmakers' Epstein files search history
A man in a suit stands on a talk show stage. The caption at the bottom reads, "It's such a delicate balance between stupid and evil."


CES 2026: Meet RocX, the handheld camera with AI tracking at 50x zoom
RocX at CES Unveiled

Trending on Mashable
NYT Connections hints today: Clues, answers for April 3, 2026
Connections game on a smartphone

Wordle today: Answer, hints for April 3, 2026
Wordle game on a smartphone

NYT Connections hints today: Clues, answers for April 2, 2026
Connections game on a smartphone

NYT Strands hints, answers for April 3, 2026
A game being played on a smartphone.

The Earth is glowing in new Artemis II pictures of home
One half of the Earth is seen floating in space through the open door of the Orion spacecraft.
The biggest stories of the day delivered to your inbox.
These newsletters may contain advertising, deals, or affiliate links. By clicking Subscribe, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy.
Thanks for signing up. See you at your inbox!