Do Son Koi Security unmasks DarkSpectre, a Chinese threat group that used 300+ browser extensions to spy on 8.8M users and steal corporate meeting data.
ShadyPanda
Koi Security exposed ShadyPanda, which infected 4.3M+ users by weaponizing trusted browser extensions (WeTab, Clean Master) through auto-updates. The malware performs RCE and exfiltrates data to China.