AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/27/2026 at 6:00 AM EST
Browser Infostealer Threats
Coverage from BleepingComputer, Let's Data Science, and others
Browser infostealer threats target the data and trust relationships concentrated in modern browsers, including saved passwords, cookies, autofill records, wallet extensions, password-manager stores, and active login sessions.
Examples such as AmnesiaStealer, CrashStealer, Atomic Stealer, Reaper, and REMUS show how attackers combine social engineering, fake prompts, disguised installers, and browser or Keychain access to extract information. Some operations can give attackers live control of authenticated sessions or let them bypass another password or multifactor prompt, making browser compromise relevant to account takeover, privacy, and financial security.
Looking Back
204 Day Timeline
Mar 25
Apr 22
May 20
Jun 24
Jul 22
Aug 19
Sep 16
All Articles32 articles
Important
Microsoft Threat Intelligence researchers said a counterfeit Perplexity AI Chrome extension redirected Omnibox and search queries through attacker infrastructure, advising removal and password rotation.
6/30/2026 • Data Collection & Surveillance Practices • General
MalExt Sentry researchers disclosed a June 13, 2026 campaign where two browser extensions allegedly recorded and transmitted AI prompts and responses using a hidden consent option.
6/30/2026 • Cybersecurity (Privacy-Relevant) • General
Microsoft disrupted the StegoAd campaign in Microsoft Edge extensions after the campaign stole Google sign-in passwords and two-factor codes for at least two years.
6/29/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Microsoft documented the StegoAd Edge extension campaign, active since 2021, using steganography and delayed execution to perform ad fraud and credential theft.
6/29/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Microsoft Threat Intelligence reported a malicious Chrome Web Store extension that masqueraded as Perplexity AI, hijacked search traffic, and collected browsing information.
6/30/2026 • Data Collection & Surveillance Practices • General
Gal Weizman disclosed in 2020s browser-based Prompt Forcing attacks that let malicious extensions control AI agents and access sensitive user data.
9/19/2026 • Cybersecurity (Privacy-Relevant) • General
LastPass and Delphos Labs identified an ongoing campaign using fake GitHub repositories to distribute Rapuncel, which steals credentials and personal data from Windows users.
9/18/2026 • Cybersecurity (Privacy-Relevant) • General
Elastic Security Labs identified a Brazilian KREMLIN malware operation active since mid-2025 that used malicious Chrome and Edge extensions to steal personal data from 1,515 systems, primarily in Brazil.
9/16/2026 • Cybersecurity (Privacy-Relevant) • General
Attackers used a compromised HBO Max advertising account to distribute ClickFix malware links through Reddit advertisements in a recent campaign.
9/14/2026 • Cybersecurity (Privacy-Relevant) • General
Anthropic warned Claude users in an ongoing investigation that infostealer malware on Windows and Mac computers had enabled attackers to access accounts and consume usage.
8/30/2026 • Cybersecurity (Privacy-Relevant) • General
Socket researchers identified a 16-extension malware campaign active since early 2024 that targeted Chrome and Edge users with credential, browser-history, and cryptocurrency theft.
8/30/2026 • Cybersecurity (Privacy-Relevant) • General
Jamf researchers identified AmnesiaStealer in 2026 as macOS malware using ClickFix distribution and hidden Chromium browsers to remotely control authenticated sessions.
8/16/2026 • Cybersecurity (Privacy-Relevant) • General
Group-IB reported ClickLock macOS malware in June after analysis showed password coercion and Telegram-based credential exfiltration across infections in 33 countries.
7/16/2026 • Cybersecurity (Privacy-Relevant) • General
Jamf researchers reported CrashStealer macOS malware using an Apple-notarized installer to bypass Gatekeeper, unlock Keychain data, and exfiltrate encrypted cryptocurrency wallet information.
7/13/2026 • Cybersecurity (Privacy-Relevant) • General
Microsoft reports a Tor-hidden USB malware campaign that replaces cryptocurrency wallet addresses and steals seed phrases by monitoring clipboard and screenshot data.
6/18/2026 • Cybersecurity Tech (Privacy-Relevant) • General
SentinelOne researchers reported SHub Reaper, a macOS infostealer using fake update prompts and AppleScript payload execution to steal Keychain credentials, browser data, and wallet assets.
5/18/2026 • Cybersecurity (Privacy-Relevant) • General
Socket researchers reported a coordinated Chrome Web Store extension campaign that used command and control infrastructure to hijack sessions and steal Google OAuth tokens.
4/14/2026 • Cybersecurity (Privacy-Relevant) • General
Gen Digital researchers reported Torg Grabber, a malware family using ClickFix and encrypted exfiltration to steal credentials and browser data from extensions.
3/25/2026 • Cybersecurity (Privacy-Relevant) • General
New Zealand's NCSC warned website owners on September 2, 2026, that ClickFix attacks can steal credentials and expose personal information through compromised websites.
9/4/2026 • Cybersecurity (Privacy-Relevant) • General
Proofpoint reported that multiple cyber-espionage groups used BlueMoon against Google Chrome users in late August, targeting U.S. organizations and Southeast Asian agencies through delayed patch deployment.
9/9/2026 • Cybersecurity (Privacy-Relevant) • General
Palo Alto Networks Unit 42 identified XCSSET version 40 attacks in mid-April and early May that targeted macOS developers through compromised Git repositories and Xcode projects.
8/4/2026 • Cybersecurity (Privacy-Relevant) • General
Manifold Security reported that Anthropic Claude for Chrome accepted untrusted JavaScript click events, enabling malicious extensions to trigger predefined AI workflows on claude.ai.
7/16/2026 • Cybersecurity (Privacy-Relevant) • General
Arctic Wolf identified a June 26 start date for 292 fake GitHub repositories distributing BoryptGrab infostealer that stole browser, crypto, and payment data.
7/14/2026 • Cybersecurity (Privacy-Relevant) • General
Flare researchers analyzed 128 REMUS MaaS posts from Feb 12 to May 8, 2026, showing development toward session theft and password-manager browser storage collection.
5/15/2026 • Cybersecurity (Privacy-Relevant) • General
Berk Albayrak at Trendyol Group reported a Google Ads and Claude shared chat campaign delivering obfuscated macOS malware that steals browser and Keychain data.
5/10/2026 • Cybersecurity (Privacy-Relevant) • General
Interesting
ClickFix and FileFix operators are using counterfeit CAPTCHA prompts to deliver malicious commands selectively to residential and mobile users through traffic distribution systems.
9/16/2026 • Cybersecurity (Privacy-Relevant) • General
SecurityIntel reported on August 17, 2026 that AmnesiaStealer targeted macOS browsers, a SafePal flaw exposed 39,798 customer records, and DDoS attacks disrupted Threema.
8/17/2026 • Cybersecurity (Privacy-Relevant) • General
Bitdefender identified an evolving Powercat-linked campaign distributing fake Xeno Executor installers to Roblox players through online communities since the beginning of the year.
8/3/2026 • Cybersecurity (Privacy-Relevant) • General
Adform removed malicious code from its hosted tracking scripts on July 27, 2026, after Kevin Beaumont identified cryptocurrency wallet manipulation and visitor-data transmission on affected websites.
7/31/2026 • Cybersecurity (Privacy-Relevant) • General
Jamf reported an Atomic Stealer macOS campaign that uses fake Apple-themed disk cleanup pages and Script Editor applescript:// execution to steal Keychain, browser, and payment data.
4/8/2026 • Cybersecurity (Privacy-Relevant) • General
Malwarebytes reports a macOS info-stealing campaign named Infinity Stealer using ClickFix fake Cloudflare CAPTCHA delivery and a Nuitka-compiled native binary for screenshot theft and C2 exfiltration.
3/28/2026 • Cybersecurity (Privacy-Relevant) • General
SOCRadar identified Russian service DOUBLECUP in June 2026 using fake CAPTCHA ClickFix sites and browser-cached PNG images to deliver malware against Windows and macOS users.
8/3/2026 • Cybersecurity (Privacy-Relevant) • General