The Browser-in-the-Middle: How Shadow Extensions Hijack CI/CD Pipelines

As organizations heavily invest in Zero Trust architectures, Phishing-Resistant MFA, and stringent identity controls, the traditional avenues for compromising software supply chains are rapidly closing. But attackers are nothing if not adaptable. Instead of breaking through the front door, they are hitching a ride with the developers themselves—directly inside their web browsers.

Welcome to the era of the Browser-in-the-Middle (BitM) attack, where malicious browser extensions—often disguised as benign productivity tools—are silently hijacking CI/CD pipelines, bypassing enterprise security controls, and poisoning codebases.

The Blind Spot in Zero Trust

Zero Trust assumes that the network is hostile and verifies every request based on identity and device posture. However, most Zero Trust implementations implicitly trust the application layer once a session is established. If a developer successfully authenticates into GitHub, GitLab, or an AWS Console using FIDO2 hardware keys, the resulting session token is considered golden.

This is precisely where shadow extensions strike. Because a browser extension operates within the context of the authenticated user's browser, it inherits the user's active sessions. It doesn't need to steal a password or intercept an MFA prompt; it simply waits for the developer to unlock the door.

Diagram of a session-hijacking attack where a malicious extension piggybacks on active browser authentication to inject background API calls.

How Shadow Extensions Hijack the Pipeline

The attack lifecycle of a malicious extension targeting a developer typically follows a stealthy, multi-stage process:

1. The Lure: Developers are frequent consumers of browser extensions. JSON formatters, color pickers, ad blockers, and AI-assisted writing tools are staples of the modern workflow. Attackers either publish seemingly legitimate tools or purchase popular, abandoned extensions to push a malicious update.
2. Permission Overreach: The extension requests broad permissions, such as <all_urls> or webRequest, allowing it to read and modify the Document Object Model (DOM) and intercept network requests across all tabs.
3. Session Riding: Once the developer logs into their source code management (SCM) or cloud provider portal, the extension wakes up. It can silently extract short-lived session cookies or OAuth tokens, transmitting them to a command-and-control (C2) server.
4. Action via API: In more advanced scenarios, the extension doesn't even bother exfiltrating tokens. It uses the developer's active browser session to make silent API calls in the background. This can include approving malicious pull requests, modifying branch protection rules, or injecting backdoors into cloud-hosted IDEs like GitHub Codespaces.

Because these actions originate from a known, trusted device and a verified identity, they are incredibly difficult to distinguish from legitimate developer activity in audit logs.

Defending the Browser Perimeter

Securing the software supply chain now requires treating the web browser as a critical attack surface. Organizations must implement defense-in-depth strategies to mitigate the risk of shadow extensions:

• Enterprise Browser Policies: The most effective defense is strict extension governance. Organizations should use Mobile Device Management (MDM) or Group Policy Objects (GPO) to enforce a default-deny policy for browser extensions, allowing only a vetted list of approved add-ons.
• Browser Isolation: For highly sensitive tasks, consider implementing Remote Browser Isolation (RBI) or Enterprise Browsers. These solutions separate the browsing environment from the local machine, severely limiting the impact of local extensions.
• Step-Up Authentication: Enforce step-up authentication (requiring a hardware key tap) not just at login, but for critical destructive or high-privilege actions within the SCM, such as modifying pipeline configurations or merging code into the main branch.
• Continuous Behavioral Monitoring: Shift from static identity verification to continuous session monitoring. Security teams should look for anomalous API call volumes or actions occurring at unusual speeds, which may indicate automated extension activity rather than human interaction.

Conclusion

The software supply chain is only as secure as the environments used to build it. As attackers pivot away from traditional credential theft and focus on session hijacking via the browser, security teams must expand their perimeter. By locking down browser environments and enforcing strict extension governance, organizations can close this dangerous blind spot and keep their CI/CD pipelines secure.