# Coordinated Campaign of 32 Malicious Chrome/Edge Productivity Extensions Conducting Surveillance and Affiliate-Fraud Traffic Redirection

> Akamai (LayerX Research) reports a coordinated campaign of 32 malicious browser extensions on the Chrome Web Store and Microsoft Edge Add-ons Store, installed by 6,150+ users. The extensions pose as productivity tools but monitor browsing and redirect tabs, driven by attacker-controlled remote configuration; artifacts point to Korean-speaking operator(s) and Coupang affiliate-fraud monetization.

- **Published:** 2026-10-01T00:00:00Z
- **Last reviewed:** 2026-10-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2821
- **ID:** TL-2026-2821
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Akamai Security Research (Natalie Zagarov, published 2026-09-30) documents a family of 32 browser extensions published to the Chrome Web Store and Microsoft Edge Add-ons Store since March 2025, with ongoing development and new variants published over subsequent months. The extensions are branded as ordinary utilities: Youtube Detox, Eye Rest Reminder, Quick Memo, KoreaDropdown, Language Learning, YouTube Summary, SnapShot, Copy as Markdown, YouTube Enhancer, SEO Toolkit, Text Counter, Web Highlighter, Page Ruler, Video Speed Controller, Tab Manager, Scroll to Top, Holiday D-day, Reaction Time Test, Reading Time, Image Downloader, Auto Scroll, Air Quality Monitor and GitHub Korean (the largest at about 4,000 installs). Total reach is over 6,150 users.

Despite different branding, the variants share one background service worker implementation, identical telemetry events and storage structures, and common navigation logic. They request broad permissions (<all_urls>, webNavigation, tabs, session storage and chrome.tabs.update()), which are unrelated to their advertised functions.

At runtime each extension retrieves an attacker-controlled configuration from a GitHub-hosted file served via the jsDelivr CDN (cdn.jsdelivr.net/gh/chosanghyeon-dev/chosanghyeon-dev@main/cf.json), with a secondary Cloudflare Workers endpoint (api.pvmf.workers.dev) identified as command-and-control infrastructure. Hostnames, redirect targets and identifiers in the config are Base64-encoded and decoded in the extension. Because behavior is driven by external configuration, the operator can change it without a store update; Akamai observed configuration changes including temporary empty states and new affiliate rules.

The extensions continuously watch browsing activity through the webNavigation API (onCompleted event) and, when the remote rules match, rebuild a destination URL from the config and redirect the tab using chrome.tabs.update(). Observed redirect targets are two Coupang affiliate short links (link.coupang.com/a/dUnRI6 and link.coupang.com/a/ej6z6U), indicating affiliate-fraud monetization. Akamai notes the same infrastructure could support broader malicious navigation manipulation.

Attribution is limited to Korean-speaking actor(s): Korean-language identifiers, embedded Korean localization resources and Korean development comments, a Korean-market affiliate program, and an associated email (indie05hacker@gmail.com) and GitHub account (chosanghyeon-dev). The public GitHub profile lists a Seoul location and UTC+9 timezone. The profile's ownership is not independently verified, and it could be a compromised or impersonated account. Severity is analyst-assigned (no CVE/CVSS). At analyst check on 2026-10-01 the jsDelivr cf.json URL returned HTTP 404 and BeaconBeagle returned no config match for api.pvmf.workers.dev.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1176.001 Browser Extensions
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1027.013 Encrypted/Encoded File
- T1071.001 Web Protocols
- T1102.001 Dead Drop Resolver
- T1583.006 Web Services
- T1565.002 Transmitted Data Manipulation

## Sources

- [When Productivity Extensions Become Attack Platforms (Akamai)](https://www.akamai.com/blog/security-research/2026/sep/when-productivity-extensions-become-attack-platforms)
- [GitHub profile chosanghyeon-dev (config host account)](https://github.com/chosanghyeon-dev)
- [MITRE ATT&CK T1176.001 Browser Extensions](https://attack.mitre.org/techniques/T1176/001/)
- [MITRE ATT&CK T1565.002 Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/)
- [MITRE ATT&CK T1102.001 Dead Drop Resolver](https://attack.mitre.org/techniques/T1102/001/)
- [LayerX: Akamai acquires LayerX (research-team context)](https://layerxsecurity.com/blog/layerx-joins-forces-with-google-chrome-enterprise-to-stop-malicious-browser-extensions/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2821