ShadyPanda Chrome Extension Malware Detection

doyou know@doyouknow

•updated Dec 2, 2025•124•13•1,294

This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.