ShadyPanda
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Last IoC activity
- 2026-07-12 01:01:15
- Profile updated
- 2026-07-07 12:22:26
Targeted industries: technology-and-telecommunications professional-services
Context
ShadyPanda is a threat actor behind a 7-year campaign that has infected 4.3 million users through extensions masquerading as productivity tools while functioning as comprehensive spyware. Their tactics include data exfiltration, user surveillance, and systematic collection of corporate meeting intelligence from over 28 video conferencing platforms. Notably, the WeTab extension exemplifies their capabilities, collecting full browsing history and personal data, exfiltrating to 17 different domains. The actor employs steganography to hide malicious code within PNG files and maintains persistent access through shared infrastructure across their extensions.
Reports & references
- koi.ai — Darkspectre Unmasking The Threat Actor Behind 7 8 Million Infected Browsers (report)
- koi.ai — 4 Million Browsers Infected Inside Shadypanda 7 Year Malware Campaign (report)