How to Detect Malicious Browser Extensions Draining Bank Accounts

Last month, a friend who runs a small e-commerce shop called me in a panic. Two transfers, totaling ₹184,000, had left her business account overnight. Her bank blamed her. Her antivirus reported nothing. It took forty minutes of screen-sharing to find the culprit: a browser extension called "PDF Merge Free Pro" that she'd installed eighteen months earlier and forgotten about. It had one job in her mind. In reality, it was reading every page she loaded, including her online banking dashboard, and quietly injecting a script that swapped payee account numbers when she pasted them.

This is not a rare story. Google removed more than 50 extensions from the Chrome Web Store in a single 2024 sweep after researchers found they had collectively racked up over a million installs while siphoning session cookies and form data. The uncomfortable truth is that a browser extension runs with more access to your banking session than most malware ever gets, and it does so with your explicit permission, granted in a single click you barely read.

In this guide, I'll show you exactly how to detect malicious browser extensions before they drain an account, using the same manual audit process I run on my own machines every quarter. You'll get a worked example with real permission strings, a comparison of the detection tools I actually trust, and a step-by-step walkthrough you can follow on any browser right now.

Key Takeaways

• Permissions are the real threat surface. An extension with "Read and change all your data on all websites" can see your bank session. Audit that phrase first.
• Silent updates change everything. A safe extension can turn malicious after being sold to a new owner. Recheck your installed list quarterly.
• Behavioral signs beat signatures. Antivirus rarely flags malicious extensions. Watch for slow pages, injected ads, and unexpected redirects instead.
• Fewer extensions equal fewer risks. Most users can safely uninstall 60 to 70 percent of what they have installed.
• Use a separate browser profile for banking. Zero extensions, zero risk of injection during a transfer.
• Verify the publisher and review velocity, not just the star rating, before you install anything.

Why Browser Extensions Are a Prime Target for Bank Fraud

A browser extension is not a small helper app. It's code that runs inside your browser with access defined entirely by the permissions you grant. When you approve "Read and change all your data on all websites," you've handed that code the ability to read the HTML of your banking page, capture what you type, and rewrite what you see.

Attackers love this for three reasons:

• Session hijacking is trivial. The extension can steal your authenticated session cookie, which means it doesn't even need your password or your OTP. It rides the login you already completed.
• Injection is invisible. A malicious script can change the payee account number on a transfer form after you paste it, while still displaying the correct number on screen.
• Distribution scales. One compromised extension with 500,000 users is a fraud pipeline, not a single victim.

The scariest variant is the sold extension. A developer builds something useful, gains 100,000 installs, then sells the project to a shell company that pushes a malicious update. Your browser auto-updates it overnight. The tool you trusted for two years is now hostile, and nothing on your screen tells you.

The Warning Signs of a Malicious Browser Extension

Before you open a single settings menu, learn the behavioral tells. These are the symptoms I look for when someone reports "weird stuff" happening in their browser.

Behavioral red flags

• New tabs open on their own, or your homepage and search engine changed without you touching a setting.
• Ads appear on sites that never had them, including inside your webmail or banking dashboard.
• Pages load noticeably slower because a script is scanning every element before render.
• Copied text gets altered. You paste an account number and something's off by a few digits.
• You're redirected through an unfamiliar domain before reaching a login page.
• An extension you don't remember installing appears in your list.

Metadata red flags

• The extension requests permissions unrelated to its function. A calculator does not need access to all websites.
• The developer name is generic ("App Team," "Best Tools Inc") with no website or verifiable company.
• A sudden spike in one-star reviews mentioning ads or hijacking, often after a recent update.
• The privacy policy links to a dead page or a free hosting subdomain.

If you're building a broader security habit around vetting third-party code, the same instincts apply to server-side tools. Our guide on how to secure your software supply chain covers the vendor-trust angle in detail.

How to Detect Malicious Browser Extensions: A Step-by-Step Audit

Here's the manual audit I run on Chrome, Edge, and Brave. Firefox uses slightly different menus but the same logic. Set aside fifteen minutes. Do this quarterly, and immediately after any unexplained financial activity.

1. Open your extensions page. In Chrome-based browsers, type chrome://extensions into the address bar. In Firefox, use about:addons.
2. Enable Developer Mode (toggle top-right in Chrome). This reveals each extension's ID and lets you inspect its files.
3. List every extension and its purpose. If you can't state in one sentence why an extension is installed, flag it for removal.
4. Click "Details" on each one and read the permissions. The phrase that matters most is Read and change all your data on all websites. Anything with this permission can see your banking session. Ask whether it truly needs that.
5. Check "Site access" scope. Change high-risk extensions from "On all sites" to "On click." A malicious extension that only runs when you click it can't silently scrape your bank page.
6. Verify the publisher. Click through to the Web Store listing. Confirm the developer has a real website, a working support channel, and a privacy policy that loads.
7. Inspect the update history. Note the "last updated" date. An extension untouched for two years is stale; one that updated last week with new permissions deserves scrutiny.
8. Cross-check the extension ID. Copy the ID string and search it. Legitimate extensions have consistent IDs across coverage; reported malicious ones show up in security advisories.
9. Remove anything you can't justify. When in doubt, uninstall. You can always reinstall a genuinely useful tool from the official source.

A worked example with real permission strings

Say you audit and find 14 extensions. Here's a realistic triage:

• Password manager — requests access to all sites. Justified, because it fills logins everywhere. Keep, but verify it's the official build.
• "PDF Merge Free Pro" — a PDF tool requesting Read and change all your data on all websites plus Read your browsing history. A PDF merger needs neither. Remove immediately.
• Ad blocker — requests all-site access. Justified for its function, but confirm it's a reputable open-source build like uBlock Origin, not a clone.
• "Coupon Finder Deals" — requests all-site access and reads history. Coupon extensions are a notorious data-harvesting category. Remove.
• Grammar checker — requests access to text fields on all sites. Reasonable for its purpose, but move it to On click so it isn't reading your banking form fields.

Out of 14, this user removes 5, restricts 3 to on-click, and keeps 6. Their attack surface just dropped by more than half in under fifteen minutes.

Extension Detection Tools Compared

No single tool catches everything, and antivirus is famously weak here. Below is how the main detection approaches actually stack up, based on running each against known-bad extensions.

Method	Detects permission abuse	Detects post-update changes	Detects session theft	Effort	Cost
Manual permission audit	Yes	Only if you recheck	Indirectly	Medium	Free
Traditional antivirus	Rarely	No	No	Low	Paid
Extension analyzer sites (e.g. CRXcavator-style)	Yes	No	Partial	Low	Free
Network monitor (browser DevTools)	No	Yes	Yes	High	Free
Separate banking profile (no extensions)	N/A (prevention)	N/A	Yes	Low	Free

My honest take: the manual audit plus a dedicated banking profile beats any single automated tool. Automation helps you scale the audit, but nothing replaces reading the permissions with your own eyes. If you want the DevTools network angle, open the Network tab, log into your bank, and watch for requests going to domains that aren't your bank or its known payment processors. Traffic to an unknown host during a session is a smoking gun.

Locking Down the Browser You Use for Banking

Detection is reactive. The stronger play is to shrink the blast radius so a bad extension never touches your money.

Create a zero-extension banking profile

1. In Chrome or Edge, click your profile avatar and choose Add profile.
2. Name it "Banking" and install zero extensions in it.
3. Bookmark only your bank and payment sites there.
4. Use this profile exclusively for financial activity. Never browse casually in it.

Because there are no extensions in that profile, there is nothing to read or rewrite your transfer forms. It's the single most effective step in this entire guide, and it costs n

Cover image: kunci selamat keselamatan bank by Unknown author, licensed under CC0 1.0 via Openverse.