[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1176":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1176","T1176","Software Extensions",14,"MITRE","**What attackers do.** Attackers abuse software extensions, such as browser extensions or plugins for editors and other applications, to keep access, steal data or run code. Extensions run with the trust of the host application and can see what the user sees. This serves Persistence.\n\n**How to defend.** Manage browser and development tool extensions centrally with allowlists, block installation from outside official stores and review permissions requested by approved extensions. Watch for updates that change an extension's behaviour or owner. Inventory installed extensions across endpoints regularly.\n\n**Signs to look for.** Look for extensions installed outside policy, extensions requesting access to all sites or cookies, sudden permission changes after an update, and extension processes contacting unknown domains. A common gap is having no inventory of extensions at all.","Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application. \n\nMalicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls. \n\nThe modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1176\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"browser-based-attacks-in-2026-phishing-extensions-oauth-abuse","Browser-Based Attacks in 2026: Phishing, Extensions & OAuth Abuse","2026-09-30T14:21:41.55+00:00",{"slug":25,"title":26,"published_at":27},"macsync-malware-hijacks-icloud-calendars-to-deliver-payloads","MacSync Malware Hijacks iCloud Calendars to Deliver Payloads","2026-09-24T22:20:58.618+00:00",{"slug":29,"title":30,"published_at":31},"malicious-firefox-extension-steals-google-session-cookies-via-deferred-payload","Malicious Firefox Extension Steals Google Session Cookies via Deferred Payload","2026-09-24T00:20:42.508+00:00",{"slug":33,"title":34,"published_at":35},"malicious-browser-extensions-can-hijack-ai-agents-via-bragjack-attack","Malicious Browser Extensions Can Hijack AI Agents via BragJack Attack","2026-09-19T18:20:19.36+00:00",{"slug":37,"title":38,"published_at":39},"kremlin-banking-malware-forces-malicious-browser-extensions-by-bypassing-integrity-checks","KREMLIN Banking Malware Forces Malicious Browser Extensions by Bypassing Integrity Checks","2026-09-16T20:20:20.314+00:00",{"slug":41,"title":42,"published_at":43},"kremlin-banking-malware-hijacks-browsers-to-steal-credentials-via-malicious-extensions","KREMLIN Banking Malware Hijacks Browsers to Steal Credentials via Malicious Extensions","2026-09-15T20:20:46.165+00:00",{"slug":45,"title":46,"published_at":47},"peep-toolkit-hijacks-browsers-as-backdoors-via-forged-extensions","PEEP Toolkit Hijacks Browsers as Backdoors via Forged Extensions","2026-09-07T20:20:24.058+00:00",{"slug":49,"title":50,"published_at":51},"russian-apt-groups-hijack-accounts-via-oauth-abuse-and-social-engineering","Russian APT Groups Hijack Accounts via OAuth Abuse and Social Engineering","2026-08-20T22:21:29.393+00:00",{"slug":53,"title":54,"published_at":55},"ai-powered-phishing-as-a-service-platform-targets-microsoft-365-accounts","AI-Powered Phishing-as-a-Service Platform Targets Microsoft 365 Accounts","2026-07-09T16:20:40.531+00:00",{"slug":57,"title":58,"published_at":59},"fake-perplexity-chrome-extension-silently-harvested-every-keystroke","Fake Perplexity Chrome Extension Silently Harvested Every Keystroke","2026-06-29T20:20:40.249+00:00",{"slug":61,"title":62,"published_at":63},"119-malicious-edge-extensions-used-steganography-to-steal-credentials-from-26m-users","119 Malicious Edge Extensions Used Steganography to Steal Credentials from 2.6M Users","2026-06-29T10:21:07.233+00:00",{"slug":65,"title":66,"published_at":67},"malicious-edge-extension-abuses-native-messaging-to-deploy-ransomware","Malicious Edge Extension Abuses Native Messaging to Deploy Ransomware","2026-06-24T22:21:06.147+00:00",[69,74,79,83,87,92],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",10,{"slug":75,"name":76,"problem":77,"stories":78},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",5,{"slug":80,"name":81,"problem":82,"stories":78},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":84,"name":85,"problem":86,"stories":78},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":88,"name":89,"problem":90,"stories":91},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",4,{"slug":93,"name":94,"problem":95,"stories":96},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",3,[98,104,110,115,120,125,129,133],{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-800-53","si-3","SI-3","Malicious Code Protection",13,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","2","Control 2","Inventory and Control of Software Assets",12,{"family":111,"item":112,"code":113,"title":114,"together":109},"gdpr","32","Article 32","Security of processing",{"family":105,"item":116,"code":117,"title":118,"together":119},"9","Control 9","Email and Web Browser Protections",8,{"family":105,"item":121,"code":122,"title":123,"together":124},"4","Control 4","Secure Configuration of Enterprise Assets and Software",7,{"family":105,"item":126,"code":127,"title":128,"together":124},"14","Control 14","Security Awareness and Skills Training",{"family":99,"item":130,"code":131,"title":132,"together":124},"cm-7","CM-7","Least Functionality",{"family":134,"item":135,"code":136,"title":137,"together":124},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring"]