Activity timeline
T1176.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1176.001 Browser Extensions is catalogued by MITRE ATT&CK under the Persistence tactic in the Enterprise matrix, as a sub-technique of T1176 Software Extensions. Threadlinqs maps 10 of 2980 tracked threats (0.3%) to it; by severity that is 2 critical, 6 high, 2 medium.
Threats that use T1176.001 most often also use T1071.001 Web Protocols (7 threats), T1059.007 JavaScript (6 threats), T1027 Obfuscated Files or Information (4 threats), T1036 Masquerading (4 threats), T1036.005 Match Legitimate Resource Name or Location (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
2 tracked threat actors appear in the threats that use T1176.001; the most frequent are APT31 (1), UNC6692 (1).
Mitigations
MITRE ATT&CK lists 5 mitigations for T1176.001.
Data sources
Telemetry that can reveal T1176.001, per MITRE ATT&CK.
- Command — Command Execution
- File — File Creation
- Network Traffic — Network Connection Creation
- Process — Process Creation
- Windows Registry — Windows Registry Key Creation
Threat actors using it
Tracked threats
10 tracked threats use T1176.001.
- CVE-2024-21388 - Microsoft Edge edgeMarketingPagePrivate API Abused for Covert Extension Installationmedium
- CrossBarking: Opera Browser 0-Day Private API Abuse via Cross-Browser Extension Store Attackhigh
- BlueMoon Exploit Kit Chains Chrome V8 Flaws CVE-2026-85046 and CVE-2026-87491 with Windows Kernel LPE…critical
- Fake Rabby and OKX Wallet Firefox Extensions Steal Crypto Recovery Phrases and Private Keyshigh
- Coordinated Campaign of 32 Malicious Chrome/Edge Productivity Extensions Conducting Surveillance and…medium
- Lunex Stealer Abuses Vulnerable AMD Radeon Driver (CVE-2023-20598) to Blind Security Monitoring and Steal…high
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentialscritical
- Malicious 'Free VPN' Chrome and Firefox Extensions (VPN Go) Deploy Clipboard-Stealing Malware via Trojanized…high
- MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers via the Built-in 'Opera Touch Background'…high
- UNC6692 Snow Flurries — Microsoft Teams Helpdesk Impersonation Delivers SNOW Malware Suite (SNOWBELT /…high
Detection coverage
Threadlinqs maintains 21 detection rules mapped to T1176.001 (SPL 10, KQL 7, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1176 Software Extensions — 76 tracked threats at the technique level.