> Amazing Refresh — A Malicious Chrome Extension Running Malware in the Browser

We recently uncovered a malicious browser extension affecting visitors to customer websites. It injected JavaScript into pages, hijacked outbound clicks through affiliate infrastructure, and quietly monetised user traffic. We spotted it not because a website was compromised, but because we monitor what code actually executes in the browser.Even though the customers' website and supply chain were not compromised, the browser was still executing unauthorised JavaScript in the context of their site. That meant we could still see it. From the website owner’s point of view, this is outsourced client-side compromise: your visitors can be manipulated, redirected, and monetised while they are on your site, and you may never know it is happening.How we do itWe collect and process a huge volume of telemetry data at Report URI, and sometimes that data reveals serious problems. Our main goal is to identify malicious behaviour in the JavaScript running on our customers’ websites, often introduced by traditional attacks like XSS or, more recently, supply-chain compromise. Sometimes, though, the malicious code does not come from the site or its supply chain at all. It comes from the client.Browser ExtensionsThe only browser extension that I run is the 1Password extension to integrate with my password manager, that's it. I do not run, and will not run, any other browser extension simply because they terrify me. I don't feel like many people fully understand the access to your data that a browser extension has. The ability to see what's on the page, see what you're typing, change what you see, interact with the DOM, and so much more. Browser extensions are effectively all-powerful and can do almost whatever they want. That's awesome when they provide legitimate, useful functionality, but you have a really big problem when the extension wants to do something less noble.Amazing RefreshAmazing Refresh presents itself as a simple tab auto-refresher, allowing users to set pages to automatically reload at a defined interval. While this functionality is real and works as advertised, it serves primarily as cover for a sophisticated malware operation running silently in the background.Every time a user navigates to any page in any tab, the extension fires a POST request to api.amazingrefresh.com/v1/reload, exfiltrating:The current page URLThe previous page URL (tracking navigation paths across sites)Window dimensions and user agentEvery element ID present on the pageA unique client identifier tied to the user's Google Analytics profileHere's a screenshot of the behaviour firing the request in my local Sandbox.Script injectionThe extension injects a <script> tag directly into every page the user visits, running in the MAIN world — the same execution context as the page itself, bypassing Chrome's content script sandbox. The script injected is whatever URL the C&C server has most recently instructed it to use, stored in chrome.storage.local.The default fallback script bundled with the extension (js/reload_helper.js) suppresses beforeunload dialog prompts — the "are you sure you want to leave?"browser warnings. This is not accidental; it exists to make redirects performed by the injected payload seamless and invisible to the user. It's these script injections and external communications to GA that we were detecting and alerting on at Report URI.The malicious payloadThe remotely-delivered script that we observed being served from amazingrefresh.com/js/reload_helper.js is a sophisticated affiliate hijacker that steps through the following process at the time of inspection:Geolocates the user via meetlookup.comFetches a list of affiliate domains from a CDN (1752680588.rsc.cdn77.org)Intercepts all link clicks on the pageWhen a clicked link matches a known affiliate domain, redirects it through advertisingshubb.com/pg/ — an affiliate tracking gateway — monetising the clickwithout the knowledge of the user or website ownerUses cookies to track which offers have been shown and clicked, with deduplication logic to avoid repeat redirects to the same offerSelects and prioritises offers based on the user's country, custom rates, PPS and PPL valuesEvasion techniquesThe browser extension and its behaviour are deliberately designed to avoid detection, which makes sense, and is likely how it has managed to get to almost 100,000 active installs. The extension package itself contains only innocuous looking code, so after unpacking and analysing the included code, there are no immediate alarm bells. The malicious JS payload lives on amazingrefresh.com and is served to the client dynamically only when certain conditions are met, further limiting the ability to detect the malicious behaviour. The malicious code:Uses session storage to ensure it only runs once per page load Suppresses page-leave prompts to hide redirects from the userThe payload removes itself from the DOMFingerprints the depth of iframes, possibly to avoid analysisSuppresses click events so other analytics don't see themHides the entire page during a redirectOn top of all of that, and I think quite interesting, they're using Google Analytics to monitor their infected user base, firing an event every 60 minutes to keep track of how many infected devices there are!Impact on website ownersWe detected this attack because we're closely monitoring the JavaScript running on our customers' websites, and as I said at the start, we're typically looking out for traditional XSS attacks or supply chain compromise. The injection of this malicious JavaScript is happening entirely client-side, in the browser of the visitor, but we still have visibility of what's happening because of how our product works. For many products out there, this would be impossible to detect or monitor.From our customers' perspective, outbound links on their site are being silently hijacked and monetised by a third-party, without their knowledge or consent. Visitors are being redirected through affiliate networks, potentially to different destinations than intended. The C&C architecture also means that the payload can be changed at any time to deliver anything from more aggressive adware, credential harvesting, a Magecart credit card skimmer, or just about anything that you could imagine. Whilst this doesn't represent a compromise of our customers' website, or their supply chain, this still raises genuine concerns that need to be addressed.Reporting the malicious extensionsThis extension is available for both Chrome and Edge, and we have reported it to both browser vendors including evidence of the malicious behaviour. Given that it appears to have almost 100,000 users across both browsers, I hope they can move quickly to remove the extension from the stores and affected devices. This will benefit not only those visitors to our customers' websites, but the wider ecosystem as a whole as we work to remove this malicious behaviour and protect all involved. This capability aligns well with our goal of making the web safer for everyone, not just our customers, and is something that we have been working on for over a decade. My first blog post on detecting and blocking client-side compromise like this was in 2015(!), Combat ad-injectors with CSP, and in 2017 I followed that up with Malware hunting with CSP. Along the way, we have also detected and reported many browser extensions that introduced malicious behaviour, just as we have done here. When we come across more interesting cases like this one, I plan to start writing about them and sharing the details, primarily because I think these cases are genuinely interesting, but also because they help demonstrate some of our lesser-known capabilities at Report URI. Indicators of CompromiseThe key indicators are:Chrome extension: linkEdge extension: linkExtension name: Amazing RefreshInjected script host: amazingrefresh.com (domain registered 19th Feb 2026)C&C server: api.amazingrefresh.comAffiliate gateway: advertisingshubb.com (domain registered 3rd Oct 2025)CDN: 1752680588.rsc.cdn77.orgGeo lookup: meetlookup.comInjected script element ID: aar_main_script Google Ads Measurement ID: G-11RPB8CJ47If you want advanced threat detection and monitoring capabilities like this on your own site, you can head over to https://report-uri.com and start a 30-day free trial. Our JavaScript Integrity Monitoring solution shouldn't take more than 60 seconds to deploy and you can start gathering your first data.