Microsoft finds 250 browser extensions linked to tracking campaign

Microsoft has uncovered a browser extension campaign called SleeperWidget that activates browsing surveillance, unwanted advertising, and affiliate-link manipulation when users install extensions through paid advertisements.

The investigation identified at least 250 related listings across Microsoft Edge Add-ons, the Chrome Web Store, and Mozilla Add-ons that posed as maps, recipe finders, package trackers, and other everyday utilities.

Microsoft’s Edge Extensions Security Team explained that the extensions behaved differently depending on how users reached their store listings, helping conceal their unwanted functionality during reviews. Researchers connected the family by correlating extension metadata, infrastructure, and observed behavior.

The campaign exploited official browser extension marketplaces, where submissions undergo checks for harmful or deceptive behavior. Most SleeperWidget extensions also delivered their advertised features, making their additional activities less obvious.

Ads unlock hidden behavior

Microsoft traced one extension, View Point 3D Earth, from a sponsored Bing result through installation and subsequent communication with its command-and-control server. Related utilities also appeared in Google advertisements.

Clicking the advertisement opened a campaign-controlled landing page, which stored an activation ticket and browser identifier before directing visitors to the official extension listing. Installation proceeded through the normal store workflow, without sideloading.

After installation, the extension opened another page on the campaign’s domain. Its content script retrieved the previously stored activation data and copied it into extension storage.

The attack flow on Chrome
Microsoft

That ticket distinguished advertising-driven installations from direct store downloads. Without it, the extension supplied its advertised widget without contacting the command server. With it, the extension could enter the hidden workflow, subject to a separate server-controlled activation setting.

Microsoft

The analyzed extension used Manifest V3, which restricts remotely hosted executable code. SleeperWidget avoided that restriction by bundling its executable components inside the reviewed package and supplying activation data separately.

Its page.js content script had access to HTTP and HTTPS pages, while the sw.js service worker handled reporting and server responses.

SleeperWidget’s complete attack chain
Microsoft

Tracking continues after ads are disabled

Once activated, the extension transmitted full page addresses and titles, potentially exposing search queries, alongside tab identifiers, focus status, and window state.

The server could return destinations for the extension to open, generating unsolicited advertising tabs and shopping redirects containing the operator’s affiliate tags.

Microsoft observed advertising and affiliate destinations during testing. However, the extension did not validate the returned URLs, leaving the same mechanism able to direct users to phishing or malware pages.

Turning off the extension’s “Sponsored content” setting stopped visible ad injection but left browsing surveillance running, with page addresses and titles still transmitted on each navigation.

Related extensions also shared a persistent user identifier. Microsoft confirmed that View Point 3D Earth and Free Digital Books Online stored the same identifier despite using different campaign domains, allowing activity across extensions to be linked. Removing one extension left identifiers held by other installed family members intact.

Microsoft began enforcement in April 2026, removing identified Edge listings and applying revocations as additional members emerged. It shared indicators with Google and Mozilla, but the report does not confirm equivalent removals from their stores.

Edge protections placed more than one million associated client identifiers into a malware-blocked state.

Users should check the list of malicious extensions and remove them immediately.