RedDirection Browser Extension Campaign

THE THREAT

On July 8th, 2025, Koi Security disclosed an extensive campaign dubbed RedDirection, involving 18 cross-platform browser extensions available on Google Chrome and Microsoft Edge markets. These malicious browser extensions can hijack browsers and have reportedly impacted 2.3 million users across Google Chrome and Microsoft Edge.

This campaign is particularly notable because several of the extensions involved have long masqueraded as legitimate, carrying a “verified” status assigned by the browsers. A malicious update to these extensions triggered the hijacking operation. Such campaigns pose a severe threat to organizations as these extensions may enable attackers carry out Man-in-the-Middle (MitM) attacks, leading to data theft or the deployment of malware.

Organizations are strongly encouraged to identify any potentially malicious extensions, and ensure they are removed.

What we’re doing about it

• eSentire has performed Threat Hunts across the client base to identify known Indicators of Compromise associated with this campaign
  • Impacted customers were notified by the eSentire SOC
• eSentire’s Tactical Threat Response team has created new eSentire MDR for Network detections to identify known Indicators of Compromise
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• Remove all affected extensions immediately from Chrome and Edge
• Clear browser data and reset browser settings to default on impacted machines to remove stored tracking identifiers
• Reset user credentials for all impacted devices
• Monitor accounts for any suspicious activity
• Review all installed extensions for similar suspicious behavior
• Educate employees about the risks associated with third-party tools such browser extensions

Additional information

Koi Security’s investigation into the browser extension “Color Picker, Eyedropper — Geco colorpick” led to the discovery of the RedDirection campaign. This extension was a legitimate tool for several years, before a malicious update was deployed. Post update, the extension continued to function as a color picker while simultaneously engaging in browser hijacking. The RedDirection campaign was found to involve 18 similar browser extensions targeting both Google Chrome and Microsoft Edge.

The browser extensions in the campaign masquerade as popular productivity and entertainment tools across a broad range of categories, including emoji keyboards, weather forecast widgets, video speed controllers, VPN proxies for Discord and TikTok, dark mode themes, volume boosters, and YouTube unblockers. Several of these extensions were marked as “verified” on both the Chrome Web Store and Microsoft Edge Add-ons, which helped them evade suspicion and gain user trust.

The browser hijacking mechanism embedded within the extensions is triggered each time a webpage is navigated. All open tabs are monitored, and the URLs are captured and sent to a remote Command-and-Control (C2) server along with a unique tracking ID. Upon receiving a redirect URL from the C2, the browser is automatically redirected to the specified destination.

The RedDirection campaign exploits the extension update mechanisms of Google Chrome and Microsoft Edge to stealthily inject malicious behavior into long-standing, previously legitimate extensions. This tactic enabled attackers to carry out a large-scale supply chain attack, leveraging weaknesses in browser extension stores and the inherent trust users place in “verified” extensions.

The known malicious plugins are now confirmed to be removed from the Chrome Web Store and Edge Add-ons.

While browser extensions can simplify many critical daily tasks and address a variety of user needs, it is essential to understand the risks associated with using third-party tools. Organizations are recommended to educate employees about the risks associated with third-party tools such browser extensions and encourage them to report suspicious behavior.

References:

[1] https://blog.koi.security/google-and-microsoft-trusted-them-2-3-million-users-installed-them-they-were-malware-fb4ed4f40ff5