I've added these to my hosts file:
Code:
0.0.0.0 api.cgatgpt.net
0.0.0.0 cleanmasters.store
0.0.0.0 dergoodting.com
0.0.0.0 extensionplay.com
0.0.0.0 s-82923.gotocdn.com
0.0.0.0 s-85283.gotocdn.com
0.0.0.0 yearnnewtab.com4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign
- Thread starter nicolaasjan
- Start date
Blocking those domains in your hosts file is a reasonable hardening step, but if you ever had any of the affected extensions installed, you should treat this as a potential privacy compromise and clean up properly.
1. About your HOSTS entries
Those entries will stop your machine from resolving those domains, which helps if:
- You still (or previously) had one of the shady extensions installed
- Some leftover script or bookmark is trying to phone home
I can’t independently verify that this is a complete or up‑to‑date list of all ShadyPanda domains, but adding these specific ones is low‑risk. Just remember this only protects that particular device; other PCs/phones/browsers won’t be affected unless you repeat the change or use a DNS‑level blocker.
2. If you ever installed Clean Master, WeTab, etc.
HOSTS blocking alone is not enough if your browser was already compromised. Do the following:
- Remove suspicious extensions immediately
- Chrome: Menu → More tools → Extensions
- Edge: Menu → Extensions → Manage extensions
- Remove anything from the same publisher as the reported extensions, or any extension you don’t absolutely trust/recognize.
- Turn off extension sync (temporarily)
Otherwise the bad extension can get re‑installed from your Google/Microsoft account:- Chrome: Settings → Sync and Google services → Manage what you sync → Turn off Extensions (or pause sync entirely)
- Edge: Settings → Profiles → Sync → Turn off Extensions
- Clear browsing data and site storage
- Clear cookies, cached images/files, and site data for at least the last 30 days (or longer if you’re worried).
- Run a reputable security scan
Use a well‑known AV/AM product already trusted on MalwareTips (e.g. Microsoft Defender, Kaspersky, ESET, Bitdefender, Malwarebytes, etc.).
This won’t see “inside” extensions perfectly, but it can catch additional payloads or other changes.
- Change passwords for important accounts
Because these extensions logged URLs/searches and had full browser access, assume:- Any passwords saved or entered in the browser might have been exposed.
- Start with email, banking, shopping, and any crypto/financial accounts.
- Use unique strong passwords + enable 2FA where available.
- Review account security
- Google/Microsoft: Check “recent activity”, “devices”, and “third‑party access” pages.
- Log out of unknown sessions and revoke suspicious third‑party app access.
3. Extra hardening you can consider
- Keep extensions to an absolute minimum – only those you truly need and from long‑established, reputable developers.
- Use a good content blocker (e.g. uBlock Origin) which can also block some third‑party calls, though it’s not a cure‑all.
- Network‑level blocking – if you have multiple devices, using something like NextDNS, AdGuard DNS, or Pi‑hole to block known C2/telemetry domains helps protect everything at once.
- Separate profiles – one browser/profile with no extensions for banking/email, another for general browsing where you keep your few trusted add‑ons.
4. If you’re unsure whether you were affected
- Check your browser’s extension history (anything installed from that publisher? Clean Master/WeTab/etc.?)
- If yes, follow the full cleanup steps above and treat it as a privacy incident.
- If no, your HOSTS entries are an extra safety net, but you’re likely fine.
If you share which browser(s) and extensions you currently use, I can help you go through them and suggest what’s safe to keep and what to remove or replace.
I actually used Clean Master for months before. No extension is safe from an abuse. 
Still got cash in your bank account?I actually used Clean Master for months before. No extension is safe from an abuse.
I am a bit troubled by Koi's report of a "Mid-2024" malware version push, whose extensions were eventually removed from the store. I want to know a more specific time when the push occurred, if anyone reported on it, and when the extension stores removed the extensions.
Anyone with any more luck searching?
Although this one seems to be on the outlier side of things, it appears this patient approach will be or is a strategy for long-term threat actors (they even incorporated in the Marshall Islands). Besides minimizing extension use, especially on important accounts, there seems to be little I can do.
Anyone with any more luck searching?
Although this one seems to be on the outlier side of things, it appears this patient approach will be or is a strategy for long-term threat actors (they even incorporated in the Marshall Islands). Besides minimizing extension use, especially on important accounts, there seems to be little I can do.
You would be right about Phase 4's attacks, but the mid-2024 malware was part of Phase 3, which the article mentioned at the end of the section:
And the beginning of Phase 4:
which if the timeline were right, maybe nobody ever caught them on Phase 3.
You may also like...
-
Zoom Stealer browser extensions harvest corporate meeting intelligence- Started by Brownie2019
- Replies: 4
-
DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide- Started by Gandalf_The_Grey
- Replies: 2
-
Trust Wallet says 2596 wallets drained in $7 million crypto theft attack- Started by enaph
- Replies: 1
-
Undetected For Years, Stantinko Malware Infected Half a Million Systems- Started by SumG
- Replies: 2
-
