Loading threat actor…
DarkSpectre is a China-linked threat actor associated with large-scale malicious browser-extension operations spanning Chrome, Edge, Firefox, and Opera. The actor has been linked to at least three major campaigns—ShadyPanda, GhostPoster, and Zoom Stealer—and is assessed to have operated for more than seven years, compromising millions of users globally. DarkSpectre’s tradecraft centers on publishing or compromising seemingly legitimate browser extensions that retain advertised functionality while covertly enabling surveillance, fraud, and data theft. Reported behaviors across its campaigns include delayed activation to evade store review, long-lived sleeper extensions later weaponized through updates, server-side configuration changes, and steganographic concealment of malicious JavaScript inside image or font assets. The actor has also used selective payload delivery, anti-analysis checks, and real-time exfiltration mechanisms. ShadyPanda has been associated with browsing surveillance, data theft, search-query hijacking, affiliate fraud, and malicious code execution in-browser. GhostPoster has been tied to Firefox-focused and broader cross-browser extension activity using hidden JavaScript payloads for affiliate hijacking, tracking injection, ad and click fraud, and related browser compromise. Zoom Stealer focused on collecting corporate meeting intelligence from numerous videoconferencing platforms, including meeting metadata, registration details, and participant or speaker information, with exfiltration occurring in real time. Reporting has characterized this activity as supportive of corporate espionage, social engineering, impersonation, and resale of stolen business intelligence. DarkSpectre has also been linked by some reporting to infrastructure overlaps with the StegoAd extension operation, which involved credential theft, cookie theft, session hijacking, ad fraud, affiliate abuse, and arbitrary JavaScript execution through malicious Edge extensions. Across reporting, attribution to China is supported by infrastructure hosted with Chinese providers, ICP registration ties to Chinese provinces, Chinese-language code artifacts, and monetization patterns aligned with Chinese e-commerce ecosystems. Known aliases include darkspectre and dark_spectre. Associated campaign names include ShadyPanda, GhostPoster, and Zoom Stealer.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
23 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Alleged Chinese corporate espionage / malware operation that Koi Security said was behind a 2.2-million-user campaign stealing corporate meeting intelligence.
Linked by Koi Security to the StegoAd credential exfiltration infrastructure; described as a Chinese operation previously connected to the ShadyPanda and GhostPoster campaigns.
A Chinese operation linked to malicious browser extension campaigns involving credential theft, ad fraud, covert telemetry, and steganography-based payload delivery.
Alleged China-linked cyber-espionage threat actor that Koi accused MeetingTV and its Zoomcorder service of fronting; described as being behind malware infections affecting over 8.8 million users.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.