By Bill Mann
Publication Date: 2026-10-26 12:08:00
Microsoft has uncovered a browser extension campaign called SleeperWidget that activates browsing surveillance, unwanted advertising, and affiliate-link manipulation when users install extensions through paid advertisements.
The investigation identified at least 250 related listings across Microsoft Edge Add-ons, the Chrome Web Store, and Mozilla Add-ons that posed as maps, recipe finders, package trackers, and other everyday utilities.
Microsoft’s Edge Extensions Security Team explained that the extensions behaved differently depending on how users reached their store listings, helping conceal their unwanted functionality during reviews. Researchers connected the family by correlating extension metadata, infrastructure, and observed behavior.
The campaign exploited official browser extension marketplaces, where submissions undergo checks for harmful or deceptive behavior. Most SleeperWidget extensions also delivered their advertised features, making their…