DarkSpectre operates three malicious browser extension campaigns: ShadyPanda (5.6M users affected), GhostPoster (focused on Firefox users), and Zoom Stealer (18 extensions). The campaigns use legitimate-looking extensions that include logic bombs with time-delayed activation (waiting 3 days before triggering malicious behavior). Extensions collect meeting URLs with passwords, IDs, topics, descriptions, scheduled times, and registration status via WebSocket connections in real-time. They harvest webinar speaker/host details, names, titles, bios, profile photos, company affiliations, logos, and session metadata. The malware performs data theft, search query hijacking, affiliate fraud, click and ad fraud, and corporate meeting intelligence gathering across 28+ video conferencing platforms.