Browser Extensions Secretly Turned 1 Million Users Into Web Scraping Bots

Browser extensions promise to make your life easier. Plant virtual trees. Block ads. Organize your tabs. What they don't mention is turning your computer into a web scraping bot.

Security researchers discovered that a library called Mellowtel has infected nearly 1 million browsers with code that secretly scrapes websites. The company markets itself as helping extension developers monetize their work through "consensual bandwidth sharing." Users think they're supporting their favorite extensions by sharing unused internet capacity.

The reality is far less charitable. Mellowtel injects hidden web pages into every site you visit, scrapes the content, and sends it back to Amazon Web Services servers. Your browser becomes an unwitting participant in a commercial web scraping operation.

The Pitch vs. The Reality

Mellowtel's GitHub page reads like a tech startup's dream manifesto. "Open-Source, Consensual, Transparent," it declares. The company promises developers an easy way to earn money without compromising user privacy. Users can "decide if they want to support you by sharing a fraction of their unused internet bandwidth."

The technical reality tells a different story. Once installed, Mellowtel waits for a delay period to avoid detection tools. Then it creates a websocket connection to AWS Lambda functions and starts receiving scraping requests. The library injects invisible iframes into whatever website you're visiting, loads the target URLs secretly, and extracts their content.

This isn't passive bandwidth sharing. It's active web scraping using your browser as cover.

Breaking Security to Make It Work

Web browsers include security features specifically designed to prevent this kind of behavior. Content Security Policy headers and X-Frame-Options tell browsers not to load certain content inside iframes. These protections exist for good reason.

Mellowtel bypasses these safeguards by requesting broad permissions from browser extension stores. The library uses declarativeNetRequest permissions to strip away security headers from every website you visit. It removes Content-Security-Policy, X-Frame-Options, and several other protection mechanisms.

Your browser becomes more vulnerable to attacks that would normally be blocked. Mellowtel claims it restores these headers after completing its scraping, but creates a window of vulnerability across all your web browsing.

The Business Behind the Library

The people running Mellowtel aren't hiding their true business model very well. Security researcher Jacob Tuckner traced the library's creators to a company called Olostep, which sells "The World's Most Reliable and Cost-effective Web Scraping API."

Olostep's documentation shows how customers can submit URLs for scraping, specify which country the request should appear to come from, and choose data formats. The service promises to avoid bot protection and parallelize requests with ease.

The connection becomes clear when you realize Mellowtel's scraping requests follow the same pattern as Olostep's API. Browser extensions running Mellowtel effectively become nodes in Olostep's commercial scraping network.

Even the "Idle Forest" extension that Mellowtel showcases as an example turns out to be run by Mellowtel employees. The supposed independent developer advocating for tree planting is actually part of the scraping operation.

The Scale of the Problem

Tuckner's research found Mellowtel embedded in extensions across all major browsers. Chrome hosts 45 affected extensions, Edge has 129, and Firefox contains 71. Nearly 1 million users have installed extensions containing this library.

Google has started removing Chrome extensions for malware, with 12 of the 45 known extensions now inactive. Edge and Firefox have been slower to respond, with only 8 and 2 extensions removed respectively.

Some extension developers have removed Mellowtel from newer versions after learning about its true functionality. Others continue running the library, either unaware of what it does or choosing to ignore the implications.

A Familiar Pattern

This isn't the first time browser extensions have been used to collect user data at scale. In 2019, researchers exposed a similar operation called Nacho Analytics that swept up browsing data from 4 million users.

That collection included surveillance videos from Nest cameras, tax returns, billing invoices, business documents, and presentation slides. The dragnet captured travel itineraries, private Facebook photos, patient information, and proprietary data from Tesla, Blue Origin, and major pharmaceutical companies.

Nacho Analytics shut down shortly after the exposure, but the underlying problem persists. Browser extensions provide a convenient way to access user data and network resources without clear disclosure or meaningful consent.

Enterprise Risks

Corporate networks face particular risks from this kind of extension behavior. Mellowtel makes arbitrary web requests that appear to come from legitimate employee browsers. Security teams monitoring network traffic might flag these requests as suspicious without realizing they're coming from a browser extension.

The library also allows scraping requests to leverage whatever network access the host computer has. An employee connected to a corporate VPN effectively gives Mellowtel access to internal networks. While the library includes some code to prevent access to authentication cookies, that protection could be bypassed by extension developers or future updates.

Companies using Olostep's scraping service could potentially access internal corporate resources through employees' browsers without those employees' knowledge or consent.

The Monetization Trap

Mellowtel exploits a real problem in browser extension development. Creating and maintaining extensions requires significant time and effort, but users rarely pay for them directly. Developers often struggle to find sustainable business models.

This creates opportunities for companies offering "monetization-as-a-service" solutions. Many of these services track user behavior to generate advertising profiles or inject affiliate links. Mellowtel's approach of turning users into scraping bots represents a new variation on this theme.

The company positions itself as a more ethical alternative to data harvesting, but the end result is similar. Users become unwitting participants in commercial operations they never explicitly agreed to join.

Why this matters:

• Browser extensions can access your computer's network and processing power for commercial purposes without clear disclosure, turning basic productivity tools into revenue-generating operations you never signed up for.

• The same techniques used for "bandwidth sharing" can potentially access corporate networks and internal resources, creating security risks that traditional monitoring might miss.