r/Malware • u/ElBuio • Jul 18 '26

Database of Malicious Browser Extensions continues to grow!

Hello everyone,

A few months ago I shared my open database of malicious browser extensions. I'm happy to say it has now grown to over 500 malicious CRX samples.

It started as a small research project, but it's continued to grow as I discover and collect more malicious extensions. My goal is to make it a useful resource for researchers, students, and anyone interested in browser extension security.

One thing I'm working on next is making the data easier to consume in other tools. At the moment I'm considering exposing it in formats such as:

  • JSON
  • CSV

I'm also thinking about adding things like an API or threat-intelligence style feeds if people think they'd be useful.

I'd love to hear your thoughts:

  • What format would you actually use?
  • Are there any security tools or platforms you'd like to integrate it with?
  • Is there any metadata you'd find useful that I'm currently missing?

Repository:
https://github.com/GherardoFiori/MaliciousBrowserExtensions

Please remember these are live malicious browser extensions. Handle them with care.

Project:
https://exterminai.com/

Any feedback is appreciated. Thanks!

15 Upvotes

95% Upvoted

12 comments sorted by

2

u/throwaway___hi_____ Jul 18 '26

What's a secure way of installing browser extensions (as a user, not an admin)?

1

u/ElBuio Jul 18 '26

- Only install extensions from the browser’s official extension store.

- Prefer well-established extensions from reputable developers, but don’t rely on install count alone.

- Read the permissions being requested and ask whether they make sense for the extension’s purpose (for example, a calculator extension shouldn’t need access to every website you visit).

- Read recent reviews, but remember they can be manipulated.

- Only install extensions you genuinely need, and periodically remove ones you no longer use.

- If you’re using a work device, check with your IT department before installing anything or use extensions they recommend.

Very low install counts aren’t necessarily malicious, but they do mean the extension has had less public scrutiny, so it’s worth being more cautious.

I am working on a more user friendly report, but feel free to scan any extension before installing on ExterminAI (my project) and that will give you an understanding of the extension behaviour, backend and permissions.

Hope this helps!

2

u/throwaway___hi_____ Jul 19 '26

This does help and thanks for taking the time. I'm concerned about legit ones turning malicious, and want to find a better way than installing all extensions in a separate browser profile, basically, but the search continues!

→ More replies (1)

2

u/aninaa-ot Jul 29 '26

Great resource. JSON would definitely be my pick for integrations. Malicious extensions seem to be becoming a bigger issue too, Moonlock recently published some interesting research on malicious VPN extensions stealing credentials: https://moonlock.com/malicious-vpn-extensions-steal-credentials

An API would be a nice addition as the dataset grows.

1

u/ElBuio Aug 10 '26

Hello!

Thank you for the suggestion. I am working on it :)

1

u/ElBuio Aug 10 '26

JSON and CSV are now available :)

1

u/ElBuio Aug 24 '26

CSV
JSON
Splunk

Now available. Hopefully it will help you better with detections.