New malware service guarantees phishing extensions on Chrome web store
Recorded: Jan. 27, 2026, 1 a.m.
| Original | Summarized |
New malware service guarantees phishing extensions on Chrome web store News Featured New ClickFix attacks abuse Windows App-V scripts to push malware Microsoft patches actively exploited Office zero-day vulnerability Nearly 800,000 Telnet servers exposed to remote attacks Cloudflare misconfiguration behind recent BGP route leak OpenAI's ChatGPT ad costs are on par with live NFL broadcasts Fortinet blocks exploited FortiCloud SSO zero day until patch is ready Chinese Mustang Panda hackers deploy infostealers via CoolClient backdoor WinRAR path traversal flaw still exploited by numerous hackers Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityNew malware service guarantees phishing extensions on Chrome web store New malware service guarantees phishing extensions on Chrome web store By Bill Toulas January 26, 2026 A new malware-as-a-service (MaaS) called 'Stanley' promises malicious Chrome extensions that can clear Google's review process and publish them to the Chrome Web Store. The MaaS has multiple subscription tiers, the most expensive one being the Luxe Plan, which also offers a web panel and full support for publishing the malicious extension to the Chrome Web Store. Stanley promoted on cybercrime portalsSource: Varonis Function that generates the deceptive iframeSource: Varonis Generating a custom notificationSource: Varonis The 2026 CISO Budget Benchmark Related Articles: Browser Extension Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Microsoft patches actively exploited Office zero-day vulnerability Microsoft investigates Windows 11 boot failures after January updates Microsoft releases emergency OOB update to fix Outlook freezes Sponsor Posts Get a free shadow AI inventory today Discover how phishing kits are sold and deployed. Download the full research report. Overdue a password health-check? Audit your Active Directory for free Exposure Management Index: Insights From 3,000+ Teams. Get The Report. Is your data already on a leak site? Monitor your exposure threats for free. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
This BleepingComputer article details the emergence of “Stanley,” a new malware-as-a-service (MaaS) platform facilitating the creation and distribution of malicious Chrome extensions, specifically designed to bypass Google’s review process and publish directly to the Chrome Web Store. The platform, promoted through cybercrime portals, offers operators a straightforward method for generating deceptive full-screen iframes containing phishing content, while maintaining the appearance of a legitimate webpage. Developed by Varonis, Stanley’s functionality centers on overlaying this deceptive iframe, allowing attackers to intercept navigation and cover targeted webpages. A key aspect of the service is its ability to enable on-demand hijacking rules, pushing notifications directly to victims’ browsers to aggressively lure them to malicious pages. The MaaS incorporates IP-based victim identification, geographic targeting, and supports persistent command-and-control (C2) polling with backup domain rotation for resilience against takedowns. Critically, the article highlights that Stanley’s code is described as “rough,” exhibiting elements like Russian comments, empty catch blocks, and inconsistent error handling, suggesting a relatively basic implementation of established malware techniques. The concerning element of this MaaS is its reported ability to successfully navigate the Chrome Web Store review process, mirroring prior instances where malicious extensions have slipped through, as indicated by reports from Symantec and LayerX. Consequently, the article emphasizes the importance for users to exercise caution by limiting the number of extensions installed, carefully reviewing user reviews, and confirming the trustworthiness of the publisher. The emergence of Stanley underscores the ongoing challenges in maintaining the integrity of the Chrome Web Store and highlights the increasing sophistication of cybercriminals leveraging services like MaaS to deploy malware more effectively. |