浏览器扩展作为现代浏览器生态的核心组件，为攻击者提供了具有合法数字签名、持久化权限和网络访问能力的理想攻击载体。传统防御主要依赖扩展商店的代码审核、数字签名验证及运行时权限监控，通过静态特征扫描检测已知恶意模块，并利用行为分析识别异常网络通信或权限滥用。然而，随着扩展API功能的不断扩展和供应链复杂性的提升，这些基于规则匹配和已知特征库的防御手段面临严峻挑战。
为突破传统检测机制的局限性，现代浏览器扩展攻击呈现出"信任滥用化"和"行为碎片化"的演进趋势。攻击者通过劫持合法开发供应链、动态化攻击载荷、云端化功能分发等手段，将恶意行为深度嵌入浏览器合法工作流程：合法扩展签名篡改技术利用数字签名体系的信任传递缺陷，实现恶意代码的"白名单化"；动态载荷云端加载通过功能模块的时空解耦，使单一时空节点的检测难以获取完整攻击画像；扩展供应链污染植入则借助软件交付链条的信任依赖，实现攻击源的"去中心化"。三类技术的共性在于充分利用浏览器生态的开放性特征，通过信任体系渗透、功能逻辑解构和攻击面稀释，将恶意行为转化为浏览器正常业务流程的组成部分。
匿迹技术的演进导致传统基于静态特征检测和单一维度行为分析的防御体系逐渐失效。防御方需构建扩展供应链完整性验证机制，实施运行时行为链式监控，并建立跨用户的扩展信誉评价体系。同时应强化扩展权限的动态沙箱隔离，采用细粒度网络流量上下文分析技术，实现对隐蔽通信行为的深度识别。
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ✅ |
| 行为透明 | ❌ |
| 数据遮蔽 | ✅ |
| 时空释痕 | ✅ |
攻击者通过复用合法扩展的数字签名和功能框架，将恶意模块伪装成浏览器正常组件。例如在供应链污染攻击中，恶意代码被嵌入官方签名的扩展安装包，使得防御方难以通过代码来源和签名有效性进行真伪鉴别。扩展运行时调用浏览器原生API执行恶意操作，使行为特征与合法扩展高度相似，实现攻击行为的深度伪装。
采用TLS加密通信和协议模拟技术隐藏恶意流量特征。动态载荷云端加载技术将攻击指令和渗漏数据封装在HTTPS流量中，利用浏览器扩展的合法网络权限建立加密信道，使防御方无法通过流量解密获取有效攻击证据，实现数据传输过程的全面遮蔽。
通过模块化架构和按需加载机制稀释攻击特征。云端化载荷分发使完整攻击链分散在多个时间段的网络交互中，单次通信仅包含碎片化指令。扩展更新机制被用于分阶段激活恶意功能，使得攻击特征分布在长达数月的版本迭代周期内，传统基于短期行为分析的检测手段难以有效关联。
| ID | Name | Description |
|---|---|---|
| S0482 | Bundlore |
Bundlore can install malicious browser extensions that are used to hijack user searches.[1] |
| S0531 | Grandoreiro |
Grandoreiro can use malicious browser extensions to steal cookies and other user information.[2] |
| G0094 | Kimsuky |
Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.[3][4] |
| S1122 | Mispadu |
Mispadu utilizes malicious Google Chrome browser extensions to steal financial data.[5] |
| S0402 | OSX/Shlayer |
OSX/Shlayer can install malicious Safari browser extensions to serve ads.[6][7] |
| ID | Mitigation | Description |
|---|---|---|
| M1047 | Audit |
Ensure extensions that are installed are the intended ones as many malicious extensions will masquerade as legitimate ones. |
| M1038 | Execution Prevention |
Set a browser extension allow or deny list as appropriate for your security policy. [8] |
| M1033 | Limit Software Installation |
Only install browser extensions from trusted sources that can be verified. Browser extensions for some browsers can be controlled through Group Policy. Change settings to prevent the browser from installing extensions without sufficient permissions. |
| M1051 | Update Software |
Ensure operating systems and browsers are using the most current version. |
| M1017 | User Training |
Close out all browser sessions when finished using them to prevent any potentially malicious extensions from continuing to run. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments for usage of the profiles tool, such as profiles install -type=configuration. |
| DS0022 | File | File Creation |
Monitor for newly constructed files and/or all installed extensions maintain a plist file in the /Library/Managed Preferences/username/ directory. Ensure all listed files are in alignment with approved extensions |
| DS0029 | Network Traffic | Network Connection Creation |
Monitor for newly constructed network connections that are sent or received by untrusted hosts. |
| DS0009 | Process | Process Creation |
Monitor for newly executed processes that could be used to abuse internet browser extensions to establish persistence. |
| DS0024 | Windows Registry | Windows Registry Key Creation |
Monitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation. |