# T1176.001 Browser Extensions > As of 2026-10-17, T1176.001 (Browser Extensions) appears in 10 tracked threats, first reported 2026-04-23 and most recently 2026-10-17, with linked actors including APT31, UNC6692; it most often appears alongside T1071.001 (Web Protocols). - **Tracked threats:** 10 (2 critical, 6 high, 2 medium) - **First seen:** 2026-04-23 - **Last seen:** 2026-10-17 - **Threat actors:** 2 - **Detection rules:** 21 (counts only; Blue tier and above) ## Key facts - **ID:** T1176.001 - **Framework:** MITRE ATT&CK - **Tactics:** Persistence - **Matrix:** Enterprise - **Parent:** T1176 - **Data as of:** 2026-10-17 - **MITRE:** https://attack.mitre.org/techniques/T1176/001/ ## Activity timeline T1176.001 first appeared in tracked threats on 2026-04-23 and was most recently reported on 2026-10-17. The busiest month was 2026-10 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1176.001 Browser Extensions is catalogued by MITRE ATT&CK under the Persistence tactic in the Enterprise matrix, as a sub-technique of [T1176 Software Extensions](https://intel.threadlinqs.com/technique/T1176). Threadlinqs maps 10 of 3000 tracked threats (0.3%) to it; by severity that is 2 critical, 6 high, 2 medium. Threats that use T1176.001 most often also use [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (7 threats), [T1059.007 JavaScript](https://intel.threadlinqs.com/technique/T1059.007) (6 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (4 threats), [T1036 Masquerading](https://intel.threadlinqs.com/technique/T1036) (4 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 2 tracked threat actors appear in the threats that use T1176.001; the most frequent are [APT31](https://intel.threadlinqs.com/actor/APT31) (1), [UNC6692](https://intel.threadlinqs.com/actor/UNC6692) (1). ## Mitigations MITRE ATT&CK lists 5 mitigations for T1176.001. - [M1017 User Training](https://attack.mitre.org/mitigations/M1017/) - [M1033 Limit Software Installation](https://attack.mitre.org/mitigations/M1033/) - [M1038 Execution Prevention](https://attack.mitre.org/mitigations/M1038/) - [M1047 Audit](https://attack.mitre.org/mitigations/M1047/) - [M1051 Update Software](https://attack.mitre.org/mitigations/M1051/) ## Data sources Telemetry that can reveal T1176.001, per MITRE ATT&CK. - Command — Command Execution - File — File Creation - Network Traffic — Network Connection Creation - Process — Process Creation - Windows Registry — Windows Registry Key Creation ## Threat actors using it - [APT31](https://intel.threadlinqs.com/actor/APT31) — 1 - [UNC6692](https://intel.threadlinqs.com/actor/UNC6692) — 1 ## Tracked threats 10 tracked threats use T1176.001. - [CVE-2024-21388 - Microsoft Edge edgeMarketingPagePrivate API Abused for Covert Extension Installation](https://intel.threadlinqs.com/threat/TL-2026-3789) — medium — 2026-10-17 - [CrossBarking: Opera Browser 0-Day Private API Abuse via Cross-Browser Extension Store Attack](https://intel.threadlinqs.com/threat/TL-2026-3787) — high — 2026-10-16 - [BlueMoon Exploit Kit Chains Chrome V8 Flaws CVE-2026-85046 and CVE-2026-87491 with Windows Kernel LPE…](https://intel.threadlinqs.com/threat/TL-2026-3185) — critical — 2026-10-10 - [Fake Rabby and OKX Wallet Firefox Extensions Steal Crypto Recovery Phrases and Private Keys](https://intel.threadlinqs.com/threat/TL-2026-3088) — high — 2026-10-09 - [Coordinated Campaign of 32 Malicious Chrome/Edge Productivity Extensions Conducting Surveillance and…](https://intel.threadlinqs.com/threat/TL-2026-2821) — medium — 2026-10-01 - [Lunex Stealer Abuses Vulnerable AMD Radeon Driver (CVE-2023-20598) to Blind Security Monitoring and Steal…](https://intel.threadlinqs.com/threat/TL-2026-2664) — high — 2026-09-26 - [EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials](https://intel.threadlinqs.com/threat/TL-2026-2600) — critical — 2026-09-21 - [Malicious 'Free VPN' Chrome and Firefox Extensions (VPN Go) Deploy Clipboard-Stealing Malware via Trojanized…](https://intel.threadlinqs.com/threat/TL-2026-1198) — high — 2026-07-10 - [MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers via the Built-in 'Opera Touch Background'…](https://intel.threadlinqs.com/threat/TL-2026-0770) — high — 2026-06-10 - [UNC6692 Snow Flurries — Microsoft Teams Helpdesk Impersonation Delivers SNOW Malware Suite (SNOWBELT /…](https://intel.threadlinqs.com/threat/TL-2026-0415) — high — 2026-04-23 ## Related CVEs CVEs referenced by the tracked threats that use T1176.001, most frequent first. - [CVE-2023-20598](https://intel.threadlinqs.com/cve/CVE-2023-20598) - [CVE-2026-85046](https://intel.threadlinqs.com/cve/CVE-2026-85046) - [CVE-2026-85880](https://intel.threadlinqs.com/cve/CVE-2026-85880) - [CVE-2026-87491](https://intel.threadlinqs.com/cve/CVE-2026-87491) ## Detection coverage Threadlinqs maintains 21 detection rules mapped to T1176.001 (SPL 10, KQL 7, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only. 21 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1176 Software Extensions](https://intel.threadlinqs.com/technique/T1176) — 76 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1176.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)