--- title: Attack of The Extensions | daily.dev description: Browser extensions can be silently installed into Chromium profiles by manipulating the Secure Preferences file and recalculating its HMAC integrity metadata,... canonical: https://daily.dev/posts/attack-of-the-extensions-zeesjfqqp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Attack of The Extensions | daily.dev og:description: Browser extensions can be silently installed into Chromium profiles by manipulating the Secure Preferences file and recalculating its HMAC integrity metadata,... og:url: https://daily.dev/posts/attack-of-the-extensions-zeesjfqqp og:image: https://api.daily.dev/og/posts/zEeSJFqqP.png og:image:alt: Attack of The Extensions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Attack of The Extensions **[SpecterOps](https://daily.dev/sources/specterops)** · 26 min read · 0 upvotes · 0 comments ## Summary Browser extensions can be silently installed into Chromium profiles by manipulating the Secure Preferences file and recalculating its HMAC integrity metadata, turning Chrome or Edge into a persistent C2 platform. The post introduces SilentChrome-BOF, a Beacon Object File that automates this sideloading process, and Ditto, a proof-of-concept Mythic C2 agent built as a Chromium extension. Ditto supports optional sidecars: an Isolated Web App (IWA) for SOCKS pivoting via Direct Sockets, and a Rust-based Native Messaging Host for OS-level operations like process listing, file I/O, and COFF execution. The post covers the full technical workflow — extension ID derivation, HMAC recalculation, IWA installation across LevelDB and protobuf records, and native messaging host registry setup — along with detection strategies using Sysmon and a key prevention: enforcing ExtensionDeveloperModeSettings policy to block unpacked extension loading. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Chromium detect tampering with the Secure Preferences file and how can the HMAC be recalculated to silently install an extension? Chromium uses HMAC-SHA256 keyed with a hardcoded chrome_seed, the user's trimmed SID, the preference path, and the serialized preference value to protect settings like extension install state and developer mode. To silently install an extension, all three values — the extension state under extensions.settings., the developer_mode flag, and protection.super_mac — must be recalculated. Newer Chromium versions also store an encrypted_hash dictionary; removing the entire dictionary triggers a self-healing fallback that accepts the legacy HMAC map. _Red teamers tracking Chromium internals changes that affect browser-based persistence techniques follow developments like these on daily.dev._ ### What is the key prevention against silently sideloading unpacked Chromium extensions via profile manipulation? Setting the ExtensionDeveloperModeSettings policy to Disallow (1) as a mandatory Chrome or Edge enterprise policy prevents unpacked extensions from loading. When enforced, any sideloaded extension returns the error DISABLE_UNSUPPORTED_DEVELOPER_EXTENSION and its service worker never starts, blocking the entire technique regardless of how the Secure Preferences file was modified. _Security engineers hardening enterprise Chrome deployments against this class of persistence find policy-level controls discussed on daily.dev._ ### How can I detect silent Chromium extension installation or Native Messaging Host registration using Sysmon? Monitor Sysmon Event ID 11 (File Create) for writes to files named Preferences or Secure Preferences under any User Data path, excluding chrome.exe and msedge.exe as the writing process. For Native Messaging Hosts, monitor Sysmon Event IDs 12 and 13 (Registry Value Created/Set) under HKCU\SOFTWARE\*\*\NativeMessagingHosts\*. Native messaging host process launches are visible in Event ID 1 via named pipes matching \\.\pipe\chrome.nativeMessaging.*. _Defenders building detection coverage for browser-based tradecraft track new Sysmon rules and attacker techniques on daily.dev._ ## Similar posts on daily.dev - [The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions](https://daily.dev/posts/the-extension-you-never-installed-kremlin-forges-chrome-s-own-integrity-checks-to-steal-banking-ses-f4tptpg8f) · Elastic Security Labs · 0 upvotes · 0 comments - [Detecting browser extensions for bot detection, lessons from LinkedIn and Castle](https://daily.dev/posts/detecting-browser-extensions-for-bot-detection-lessons-from-linkedin-and-castle-nu1uxbkhl) · Security Boulevard · 0 upvotes · 0 comments - [Spying Chrome Extensions: 287 Extensions spying on 37M users](https://daily.dev/posts/spying-chrome-extensions-287-extensions-spying-on-37m-users-zc89tp8r9) · Hacker News · 0 upvotes · 0 comments - [Browser Extensions Are the New Malware Dropper](https://daily.dev/posts/browser-extensions-are-the-new-malware-dropper-8rxy2hs4d) · InfoSec Write-ups · 0 upvotes · 0 comments - [Malware bypasses browser checks to force install Chrome, Edge extensions](https://daily.dev/posts/malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions-hxlx1l2zf) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#devtools](https://daily.dev/tags/devtools), [#chromium](https://daily.dev/tags/chromium), [#red-teaming](https://daily.dev/tags/red-teaming) [View this post on daily.dev](https://daily.dev/posts/attack-of-the-extensions-zeesjfqqp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Attack of The Extensions","url":"https://daily.dev/posts/attack-of-the-extensions-zeesjfqqp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/attack-of-the-extensions-zeesjfqqp"},"datePublished":"2026-08-23T12:16:29.307Z","dateModified":"2026-08-23T12:17:55.475Z","description":"Browser extensions can be silently installed into Chromium profiles by manipulating the Secure Preferences file and recalculating its HMAC integrity metadata,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fd22ec6d9e2d635a1f67b6fecce3ff4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fd22ec6d9e2d635a1f67b6fecce3ff4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/attack-of-the-extensions-zeesjfqqp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,chromium,red-teaming","timeRequired":"PT26M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"Attack of The Extensions"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/attack-of-the-extensions-zeesjfqqp#faq","mainEntity":[{"@type":"Question","name":"How does Chromium detect tampering with the Secure Preferences file and how can the HMAC be recalculated to silently install an extension?","acceptedAnswer":{"@type":"Answer","text":"Chromium uses HMAC-SHA256 keyed with a hardcoded chrome_seed, the user's trimmed SID, the preference path, and the serialized preference value to protect settings like extension install state and developer mode. To silently install an extension, all three values — the extension state under extensions.settings., the developer_mode flag, and protection.super_mac — must be recalculated. Newer Chromium versions also store an encrypted_hash dictionary; removing the entire dictionary triggers a self-healing fallback that accepts the legacy HMAC map. Red teamers tracking Chromium internals changes that affect browser-based persistence techniques follow developments like these on daily.dev."}},{"@type":"Question","name":"What is the key prevention against silently sideloading unpacked Chromium extensions via profile manipulation?","acceptedAnswer":{"@type":"Answer","text":"Setting the ExtensionDeveloperModeSettings policy to Disallow (1) as a mandatory Chrome or Edge enterprise policy prevents unpacked extensions from loading. When enforced, any sideloaded extension returns the error DISABLE_UNSUPPORTED_DEVELOPER_EXTENSION and its service worker never starts, blocking the entire technique regardless of how the Secure Preferences file was modified. Security engineers hardening enterprise Chrome deployments against this class of persistence find policy-level controls discussed on daily.dev."}},{"@type":"Question","name":"How can I detect silent Chromium extension installation or Native Messaging Host registration using Sysmon?","acceptedAnswer":{"@type":"Answer","text":"Monitor Sysmon Event ID 11 (File Create) for writes to files named Preferences or Secure Preferences under any User Data path, excluding chrome.exe and msedge.exe as the writing process. For Native Messaging Hosts, monitor Sysmon Event IDs 12 and 13 (Registry Value Created/Set) under HKCU\\SOFTWARE\\*\\*\\NativeMessagingHosts\\*. Native messaging host process launches are visible in Event ID 1 via named pipes matching \\\\.\\pipe\\chrome.nativeMessaging.*. Defenders building detection coverage for browser-based tradecraft track new Sysmon rules and attacker techniques on daily.dev."}}]} ```