# Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts

> **Open Intelligence Dossier** · First detected: 2026-06-29 19:07 UTC · Category: Technology

## Executive Summary
Microsoft pulls 119 malicious Edge extensions, exposing a two‑year StegoAd campaign that reached up to 2.6 million users

## Intelligence Brief
Microsoft removed 119 Edge browser extensions that concealed malware in images and fonts, a operation dubbed StegoAd that ran for two years and affected up to 2.6 million users. Coverage highlights the security breach across several outlets: Redmondmag reported the disruption of the StegoAd campaign; Malwarebytes noted the extensions downloaded malware; Security Affairs detailed credential theft and ad‑fraud activities; TipRanks observed a slip in Microsoft’s stock price; Risky Business and The Hacker News both announced the takedown.


Future reporting will likely track additional Microsoft security measures, any further extension removals, and continued market reaction to the stock movement noted by TipRanks.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Redmondmag.com | Microsoft Disrupts StegoAd Extension Campaign Affecting Up to 2.6 Million Users | [Source Link](https://news.google.com/rss/articles/CBMimAFBVV95cUxONGFKU0FjVFhia0g1NU9CQThINkl6TjlVTk12RVZraGQzaDExaHhpYUFMN2V4X0NvcXVQUjRPcDZ6N3ZGbDRpdk12Y0JseV9Lem5XWUVTcWYyeDdNam80eTdFajdYeUk3eUVKLTlNMlpFcTlPOTFDazFIWmI5RzVEdzVOaDdBQzZXQzdYeTBnRkhhMVR4aWdLWQ?oc=5) |
| Malwarebytes | 119 Edge extensions promised useful tools, instead downloaded malware | [Source Link](https://news.google.com/rss/articles/CBMitgFBVV95cUxQcUtXLVJDWk9PUmNLZEFBZkNyOF82dW9hLTRCb0tBcDhzeXY5dm5UeURFTGtXVHIwYW5FTHFUTDctd0o2d25jdnZhNnZxZnpTSHlZTWp3NE9ldmhZSl9zdlFVTjVMSU4zeEJCeTA3dmNtZW1MOXdoWTdyQS1STWc4YTF6RFlHNmt4UUU1VUlrb2VxYWMycVhaMlJ5Y1U3bUJZc2NoYUttMkZ3dTdUT0E0ZFA5SFJmZw?oc=5) |
| TipRanks | Microsoft Stock (NASDAQ:MSFT) Slips After Pulling 119 Edge Extensions | [Source Link](https://news.google.com/rss/articles/CBMinAFBVV95cUxNOUhpOEJ2cThheEVaODhVY20yTk51T0tNTmlMN0U2bHdmWXpua2Z2eVpiczRaWnpOUkk4cnBNMi1DbEZmZzZ0a2xpdWYxUWQ5bElFVnhKUzY5ZC04OFJuVEFlSkxhNEdIaE5xTzYtSnBKSWUyMWFFMV9xRGk1UWRiMnFRSGtaWkxnS0pvLXNmWEdSUUlkMURKNDBTeU0?oc=5) |
| Security Affairs | StegoAd: How 119 Fake Browser Extensions Stole Credentials and Ran Ad Fraud for Two Years | [Source Link](https://news.google.com/rss/articles/CBMi0gFBVV95cUxONExmNHA2ZlYzdGZxSzk0anRVZnpza21MMlNwT0RRYldvVW9lQnRTeUZGMHl4cE9vR0RDcUE5RWNpNnhKd0dmZldSM25DSktYektzODlUZlh0TGIzenZ3Qm9XY0FwSVVKZTExV2doT2hTWGRxYkdfTTdEY1RlMW8zRF92VTM1MkZoS24yemlNNTlmZmU4NVNfZ0NfekxjV1dzMktkTi1sWjByYm83ZTU3dWhyejNSdk5WZHc1Nm85aDhiRWtaLXoxbmFQb2xJSkFra0HSAdcBQVVfeXFMUHdEVW9ORHFYckNmVDdoUFJLclIydTlGRzZmaEV0T3FxcVBYM2ZUSElVNDdEUUlGSHFEZDdSRjg4STItUDJJX1BvaEhSbndBRGRLTmlVM09ZNG4zRTBESkU1cVQ2bm05czN3QndDUWpRaEJZbnk5QU5rQUw3SVU5WFN) |
| Risky Business Newsletters | Microsoft takes down StegoAd operation | [Source Link](https://news.google.com/rss/articles/CBMigAFBVV95cUxPZ3BVVW9lTzNGYVJjYkZBOGJWa2Z4ZnliR3h2cDNsYTQ4NHpFQUV3TzZQVG0ycG1HTXVnYmpodENoUERxMkNCTjRuTWJ2cmI5QWhud3BvVWxiRFh4T0xiMlZmY3dxVlk3MHVrR0I0QTM0WlRmcXdWMzRhczZyMktOeg?oc=5) |
| The Hacker News | Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts | [Source Link](https://news.google.com/rss/articles/CBMiggFBVV95cUxNaUVGWHdDckhFYXNtX1d6YVNaQjI4WmphbVRPa3BwWnF2bVpFXzNUQjRWSnBESkFUYlJxeXlWLXVkUW1ZUzNMR2RFVUVkbmxrRjBWVUxsdzJ6RHlvNjNhZ2VFOW5GVGlyc2xmeXZOMk52SndGY2xfUGJHSXZZMUpLSHd3?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-06-29/microsoft-removes-119-edge-extensions-that-hid-malware-in-images-and-fonts*