Quick Summary
A new malware-as-a-service called ‘Stanley’ offers malicious Chrome extensions that can bypass Google’s review process. This service allows attackers to overlay phishing content on legitimate websites using full-screen iframes. With features like silent auto-installation on multiple browsers and geographic targeting, Stanley poses significant risks to users and organizations alike.
The Securityish Brief
Stanley is a new malware-as-a-service (MaaS) that enables the creation of malicious Chrome extensions capable of evading Google’s review process. Researchers from Varonis report that this service allows attackers to display phishing content over legitimate websites through full-screen iframes, while the browser’s address bar remains unchanged, showing the real domain. This tactic can mislead users into entering sensitive information.
The service supports silent auto-installation on Chrome, Edge, and Brave browsers, making it easier for attackers to deploy these extensions without user consent. Stanley offers various subscription tiers, including a Luxe Plan that provides a web panel for managing the malicious extensions and full support for publishing them on the Chrome Web Store.
Operators using Stanley can customize their attacks by enabling or disabling hijacking rules and sending notifications directly to victims’ browsers. The malware also features persistent command-and-control (C2) polling every 10 seconds and can rotate backup domains to maintain functionality even after takedown efforts.
Despite its straightforward approach, Stanley’s distribution model is particularly concerning as it claims to successfully navigate the Chrome Web Store’s review process. This highlights ongoing vulnerabilities in the platform, as evidenced by recent reports from Symantec and LayerX, which documented multiple malicious extensions slipping through security checks.
Implications for Users and Organizations
The emergence of Stanley underscores the importance of exercising caution when installing browser extensions. Users should limit the number of extensions they use, read reviews, and verify the trustworthiness of publishers before installation. Organizations must also be vigilant in monitoring their users’ browser environments to prevent potential phishing attacks.
As phishing techniques continue to evolve, users should remain aware of the signs of phishing attempts, such as unexpected notifications or requests for sensitive information. Regularly updating browser security settings and educating users about safe browsing practices can help mitigate risks associated with these types of malware.
Key Takeaways
- Limit the number of browser extensions you install to reduce exposure to potential malware.
- Always read user reviews and verify the publisher’s trustworthiness before adding any extension.
- Regularly update your browser and its security settings to protect against emerging threats.
- Be cautious of unexpected notifications or requests for sensitive information while browsing.
- Educate yourself and your team about phishing tactics to recognize and avoid potential attacks.
Key Terms & Concepts
- Malware-as-a-Service (MaaS): In this article, MaaS refers to a service that provides malicious software tools for cybercriminals to conduct attacks.
- Phishing: Phishing is a cyber attack that attempts to trick individuals into providing sensitive information by masquerading as a trustworthy entity.
- Iframe: An iframe is an HTML element that allows an external webpage to be embedded within another webpage, often used in phishing attacks to display deceptive content.
- Command-and-Control (C2): C2 refers to a method used by attackers to remotely control compromised systems, often for executing malicious activities.
Read the original article here: https://www.bleepingcomputer.com/news/security/new-malware-service-guarantees-phishing-extensions-on-chrome-web-store/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
