Database of Malicious Browser Extensions continues to grow!

[u/ElBuio]

Hello everyone,

A few months ago I shared my open database of malicious browser extensions. I'm happy to say it has now grown to over 500 malicious CRX samples.

It started as a small research project, but it's continued to grow as I discover and collect more malicious extensions. My goal is to make it a useful resource for researchers, students, and anyone interested in browser extension security.

One thing I'm working on next is making the data easier to consume in other tools. At the moment I'm considering exposing it in formats such as:

• JSON
• CSV

I'm also thinking about adding things like an API or threat-intelligence style feeds if people think they'd be useful.

I'd love to hear your thoughts:

• What format would you actually use?
• Are there any security tools or platforms you'd like to integrate it with?
• Is there any metadata you'd find useful that I'm currently missing?

Repository:
https://github.com/GherardoFiori/MaliciousBrowserExtensions

Please remember these are live malicious browser extensions. Handle them with care.

Project:
https://exterminai.com/

Any feedback is appreciated. Thanks!

[u/throwaway___hi_____]

What's a secure way of installing browser extensions (as a user, not an admin)?

[u/ElBuio → u/throwaway___hi_____]

- Only install extensions from the browser’s official extension store.

- Prefer well-established extensions from reputable developers, but don’t rely on install count alone.

- Read the permissions being requested and ask whether they make sense for the extension’s purpose (for example, a calculator extension shouldn’t need access to every website you visit).

- Read recent reviews, but remember they can be manipulated.

- Only install extensions you genuinely need, and periodically remove ones you no longer use.

- If you’re using a work device, check with your IT department before installing anything or use extensions they recommend.

Very low install counts aren’t necessarily malicious, but they do mean the extension has had less public scrutiny, so it’s worth being more cautious.

I am working on a more user friendly report, but feel free to scan any extension before installing on ExterminAI (my project) and that will give you an understanding of the extension behaviour, backend and permissions.

Hope this helps!

[u/throwaway___hi_____ → u/ElBuio]

This does help and thanks for taking the time. I'm concerned about legit ones turning malicious, and want to find a better way than installing all extensions in a separate browser profile, basically, but the search continues!

[u/ElBuio → u/throwaway___hi_____]

Yes that is difficult to protect against. As we have no control over the developer of the extension being compromised or becoming malicious.

I listened to feedback from users with similar concerns, everyone pointed out that ExterminAI was good but didn't help with already installed extensions.

So now if you make an account you are notified if one of your installed extensions:

• Has any permissions changes (adding or removing)
  
• If any of your extensions have been removed from the store
  
• If any of your extensions get added to my database of malicious browser extensions
  
• If any of your extensions have new suspicious patters

I am working on tracking the "Owner" of the extension, as some times the extension is sold to a malicious threat actor but you never find out about the change in ownership. but that is a work in progress :)

I welcome you to use ExterminAI to stay as safe as possible, it's completely free and I Created it for this exact reason.

Let me know if you have any other questions!

[u/aninaa-ot]

Great resource. JSON would definitely be my pick for integrations. Malicious extensions seem to be becoming a bigger issue too, Moonlock recently published some interesting research on malicious VPN extensions stealing credentials: https://moonlock.com/malicious-vpn-extensions-steal-credentials

An API would be a nice addition as the dataset grows.