By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.
Articles

Hidden Threats: How Malicious Browser Extensions Are Hijacking Your Banking Data

June 15, 2025
This article uncovers the growing threat of malicious browser extensions—add-ons that appear legitimate but are engineered to steal banking data, login credentials, and other sensitive information. The attack, originally identified as Operation Phantom Enigma, began in Brazil and has now evolved into a global campaign.

Browser extensions have become essential productivity tools—but now, they’re also being exploited by cybercriminals as stealthy data-stealing weapons. In a rising campaign dubbed Operation Phantom Enigma, attackers are using malicious browser add-ons to steal banking credentials, login information, and more—all while going undetected by most traditional security tools.

Originating in Brazil, this campaign has quickly evolved into a global threat, targeting both individuals and enterprises across regions, particularly in Southeast Asia and Eastern Europe.

It Starts With One Email—and One Dangerous Click

This cyberattack follows a familiar but effective path: social engineering.

  • A fake email lands in your inbox—disguised as a bank alert or invoice.
  • Attached is a malicious file—often .exe, .msi, or .zip.
  • With one click, stealth malware is installed, bypassing basic antivirus detection.

That single moment of distraction opens the door to a long-term compromise.

What Happens Behind the Scenes

Once deployed, the malware silently begins its attack:

  • Modifies system settings to weaken defenses
  • Disables security alerts so users remain unaware
  • Enables persistence, relaunching automatically every startup

But the real danger begins when a rogue browser extension is installed.

The Rogue Browser Extension Threat

Without your knowledge, a fake extension is added to your Chromium-based browser (Chrome, Edge, or Brave). These malicious extensions are engineered to:

  • ⌨️ Log keystrokes—capturing usernames, passwords, and sensitive form data
  • 🏦 Exfiltrate banking credentials in real time
  • 📤 Send stolen data to attacker-controlled servers

Worse still, these add-ons often impersonate legitimate tools—making them nearly impossible to spot without advanced monitoring.

Why It Started in Brazil—But No One Is Safe

Operation Phantom Enigma was initially focused on users of Warsaw, a Brazilian banking plugin. But the malware is modular and adaptable—capable of morphing into variants that can target new languages, platforms, and geographies.

Threat intelligence reports reveal:

  • Over 70 organizations impacted
  • More than 722 downloads of malicious extensions before takedown
  • Expansion into Southeast Asia and Eastern Europe already underway

5 Cyber Hygiene Practices to Stop Malicious Extensions

Here’s how to protect your users and systems from browser-based threats:

1. Review Installed Extensions

Go through your browser regularly. Remove unused or suspicious add-ons. Treat extensions like apps—vet their origin and update status.

2. Avoid Unverified File Attachments

Be wary of any .exe, .zip, .msi, or .bat files, even if sent by someone familiar. Always confirm via a second communication channel.

3. Use AI-Powered Endpoint Protection

Legacy antivirus isn’t enough. Solutions like Peris.ai Endpoint & Network Security offer:

  • Real-time monitoring of browser activity
  • Detection of unauthorized extension installs
  • Behavior analytics that flag suspicious changes
  • Automated incident response powered by BrahmaIRP

4. Enforce Extension Policies Company-Wide

Implement browser policies via Group Policy Objects (GPO) or Mobile Device Management (MDM) to restrict installations to pre-approved extensions only.

5. Prioritize Regional Threat Awareness

If your organization operates in Latin America, Southeast Asia, or Eastern Europe, assume elevated risk and strengthen endpoint controls immediately.

Why This Threat Is Harder to Detect

These extensions look and behave like real tools. Many even contain legitimate functionality to avoid suspicion—until they silently harvest credentials and open backdoors into your systems.

In other words: they don’t act like malware—until it’s too late.

Peris.ai Helps You Detect the Undetectable

At Peris.ai Cybersecurity, we specialize in protecting against stealthy, browser-based threats that bypass traditional defenses.

With tools like:

  • BrahmaIRP – AI-powered incident response that automates threat detection
  • BrahmaFusion – Hyperautomation platform that orchestrates defense workflows

You can identify, contain, and remediate these attacks before credentials are stolen or networks compromised.

Final Thought: Don’t Let Convenience Become Your Weakest Link

Browser extensions were designed to make your work easier—but today, attackers are using that convenience against you.

Protect your credentials, protect your endpoints, and question every tool that asks for permissions.

🛡️ Ready to secure your team’s browsers? Explore Peris.ai Endpoint Defense
There are only 2 type of companies:
Those that have been hacked, and
those who don't yet know they have been hacked.
Protect Your Valuable Organization's IT Assets & Infrastructure NOW
Request a Demo
See how it works and be amaze.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Interested in becoming our partner?
BECOME A PARTNER