UnregStealer - Local Extension Sideload Setup

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•5

Detects the creation of specific folders in AppData used to host the unpacked malicious extension locally, specifically looking for 'manifest.json' within an AppData\Local path, in conjunction with the execution of '7za.exe' (7-Zip archiver). This combination indicates the potential unpacking and setup of a malicious browser extension for sideloading, as observed in UnregStealer campaigns.