StegoAd Browser Extension Registration with Steganographic Payload Fetch

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects activity associated with the StegoAd browser extension campaign. This rule monitors for the registration of new browser extensions in Chrome or Edge, followed by suspicious browser-based network activity including DNS queries to known C2 infrastructure or the loading of specific WebP files used for steganographic payload delivery.