19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

The discovery of 19 malicious Chrome and Microsoft Edge extensions capable of stealing cryptocurrency wallet secrets, draining digital assets, harvesting credentials and injecting arbitrary code into websites is a particularly important browser-security incident because it demonstrates how trusted extension ecosystems can become software supply-chain attack platforms. Researchers identified 18 Google Chrome extensions and one Microsoft Edge extension connected to a campaign being tracked as “Superior,” with evidence suggesting that the broader activity may have been operating since February 2024. Some of the extensions were created directly by the threat actor, while others were legitimate extensions purchased from their original developers and subsequently converted into malicious tools. This second technique is especially dangerous because users may have installed an extension months or years earlier when it was completely legitimate, only to receive malicious functionality automatically through a later extension update.

The researchers identified 14 extensions that appear to have been created and published by the attackers themselves and another five that were purchased from previous owners. The acquired extensions included apparently useful browser tools such as utilities for enabling right-click and copy functionality, Google Lens-style screen searching and PDF password protection. The attacker-created extensions included SEO tools, advertising-analysis extensions and several cryptocurrency-related utilities such as wallet monitors, crypto price trackers and blockchain explorers. This diversity is strategically useful because it gives attackers access to different user communities rather than concentrating exclusively on people actively looking for cryptocurrency extensions. A seemingly innocent productivity extension can therefore become just as dangerous as an obviously crypto-focused application once malicious code is introduced through an update.

The takeover of legitimate extensions is arguably the most concerning element of the campaign. Browser-extension security traditionally focuses heavily on whether users install applications from untrusted websites or unofficial marketplaces. In this case, that advice is insufficient. An extension can originate from an official browser store, provide legitimate functionality, accumulate thousands of installations and positive reviews, and still become malicious later if ownership changes or the developer account is compromised. Users who made a perfectly reasonable security decision when installing the extension can therefore become victims without taking any new action.

Browser-extension auto-update mechanisms amplify this risk considerably. Chrome and Edge normally update installed extensions automatically so that users receive security fixes and new functionality without manual intervention. That design is beneficial when the developer remains trustworthy. Once ownership passes to a malicious actor, however, the same mechanism becomes an extremely efficient malware-distribution channel. The attacker does not need to convince tens of thousands of users to install a new malicious extension. They simply publish an updated version, and browsers distribute it automatically to the existing installation base.

This changes the security meaning of extension ownership. An extension should not be considered permanently trustworthy merely because it passed security review when originally installed. Ownership changes, developer-account compromise and malicious updates can fundamentally alter the risk profile. Browser vendors and enterprises therefore need mechanisms capable of detecting major behavioral or permission changes between extension versions rather than assuming continuity simply because the extension identifier remains unchanged.

One extension in particular, “Enable Right Click & Copy — Smart Unlock + OCR,” reportedly had approximately 80,000 installations across Chrome and Edge, giving the attackers a substantial potential victim base. Large install counts matter because malicious extensions operate directly inside users' browsers, where they may have visibility into websites, form submissions, browsing behavior and authenticated sessions depending on their permissions. A malicious browser extension can therefore operate from one of the most trusted locations on an endpoint: inside the application through which users access banking, email, social networking, cloud services and cryptocurrency platforms.

The campaign's technical architecture demonstrates that these were not simplistic credential-stealing extensions containing a single hard-coded command server. Researchers found functionality capable of establishing persistent WebSocket connections to command-and-control infrastructure. The C2 server could instruct extensions to rotate to alternative command servers, allowing the attacker to redistribute victims across different infrastructure. Data-exfiltration endpoints could also be provided dynamically on a per-victim basis. This makes infrastructure-based blocking substantially more difficult because defenders cannot simply identify one malicious server, block it and assume the campaign has been neutralized.

Dynamic command-and-control infrastructure also provides attackers with resilience. If one domain or server is detected and removed, compromised extensions can potentially receive instructions directing them toward replacement infrastructure. Different groups of victims can additionally be routed to different servers, making it harder for researchers examining one compromised system to obtain a complete picture of the attack. This resembles the resilient infrastructure architecture used by more traditional malware families and demonstrates how sophisticated browser-extension threats have become.

The malicious extensions were reportedly capable of stripping Content Security Policy headers from pages and injecting JavaScript modules into targeted websites. CSP is an important browser security mechanism designed to restrict which scripts and other resources a page is allowed to execute. If a malicious extension can interfere with that policy before the browser enforces it, the extension effectively gains the ability to weaken protections deliberately established by the website developer. The attack therefore demonstrates a fundamental challenge with browser extensions: once granted sufficient privileges, they may operate at a level powerful enough to manipulate the security controls of the pages they observe.

Researchers identified 16 malicious modules covering several categories of attack. These included a multi-chain cryptocurrency wallet drainer, a hardware-wallet seed phrase harvester, cryptocurrency exchange and wallet account credential theft, universal credential and form grabbing, Facebook and LinkedIn account theft, browser-history collection and a ClickFix-style social-engineering module. This range of capabilities indicates that the campaign was not built around one narrow cryptocurrency theft technique. The attackers created a flexible platform capable of adapting malicious functionality according to the websites and users encountered.

The cryptocurrency wallet-draining functionality is particularly dangerous because blockchain transactions are generally irreversible. Traditional banking fraud can sometimes be stopped, reversed or investigated through financial institutions. Once cryptocurrency is transferred to an attacker-controlled wallet and subsequently moved through additional addresses, mixers, decentralized exchanges or cross-chain services, recovery can become extremely difficult. Preventing compromise is therefore considerably more important than depending upon remediation after funds have been transferred.

The inclusion of hardware-wallet seed phrase harvesting is especially noteworthy because hardware wallets are usually recommended precisely because private keys remain isolated from ordinary computers. Attackers increasingly understand that compromising the cryptographic device itself may be unnecessary if they can trick the user into revealing the recovery phrase. A malicious browser extension operating around cryptocurrency websites can inject convincing prompts asking users to “verify,” “restore,” “synchronize” or “secure” their wallets and then capture the recovery seed entered by the victim.

This is an important distinction in cryptocurrency security. Hardware wallets protect private keys against many forms of endpoint compromise, but they cannot protect users who voluntarily provide their recovery phrase to malicious software. A seed phrase should therefore never be entered into a browser extension, website or unsolicited recovery interface unless the wallet's documented recovery procedure explicitly requires it. Any webpage or browser extension unexpectedly asking for a hardware-wallet recovery phrase should be treated as highly suspicious.

The ability to harvest exchange credentials extends the attack beyond self-custodied wallets. Many cryptocurrency users keep assets on centralized exchanges that rely on ordinary web authentication. A malicious extension capable of observing login forms can potentially capture usernames, passwords and other authentication information. If session cookies or tokens can also be accessed through additional techniques, attackers may be able to bypass some authentication protections entirely.

Multi-factor authentication remains valuable, but users should prefer phishing-resistant methods such as hardware security keys or passkeys wherever services support them. SMS codes and even some one-time password mechanisms can be defeated through real-time phishing or session-token theft. Cryptocurrency accounts should receive particularly strong authentication because attackers can transfer assets rapidly after successful compromise.

The universal credential and form-grabber functionality should concern users far beyond the cryptocurrency community. A browser extension capable of observing forms can potentially capture credentials submitted to email services, corporate applications, financial systems and social networks. This means a user who installed an extension for something as mundane as copying text from protected webpages could potentially expose credentials used across completely unrelated services.

This is why browser extensions effectively belong inside the endpoint-security boundary. Organizations often spend considerable effort controlling executable applications installed on corporate laptops while permitting employees to install browser extensions with minimal oversight. Yet an extension may be able to access data from dozens of applications because modern enterprise workflows increasingly take place inside the browser. Email, CRM, ERP, cloud administration, collaboration tools and developer platforms may all be accessible from a single browser session.

The campaign's Facebook and LinkedIn account-stealing modules introduce additional enterprise risk. Compromised social-network accounts can be used for fraud, impersonation, targeted phishing and business email compromise preparation. A compromised LinkedIn account belonging to an executive or employee can provide attackers with access to professional contacts and direct messaging, allowing highly convincing malicious communications to originate from a legitimate identity.

This creates potential attack chains extending beyond the originally compromised user. If an attacker steals a LinkedIn session through a malicious extension, they can potentially contact the victim's colleagues, customers or partners while impersonating that person. Those recipients may be significantly more likely to trust links or files sent through an existing professional relationship.

Browser-history theft further improves attacker reconnaissance. Browsing history can reveal which banks, cryptocurrency exchanges, cloud services, enterprise applications and internal portals a user accesses. Instead of blindly attempting credentials against hundreds of services, attackers can identify exactly which platforms are relevant to a particular victim. History information can therefore transform generic credential theft into focused account-takeover attempts.

For enterprise users, browsing history may also expose internal hostnames, cloud-management portals, administrative applications and business systems. A malicious extension could potentially use this information to understand an organization's technology environment before launching additional attacks. Security teams should therefore avoid treating browser-history exposure as merely a privacy concern.

The ClickFix-style functionality is another particularly interesting component. ClickFix attacks typically display a fake error, verification step or software-update message and instruct the victim to copy and execute a command manually. The technique exploits the fact that endpoint security may treat user-initiated commands differently from automatically downloaded malware. Instead of attempting to exploit the operating system directly, the attacker persuades the victim to become the execution mechanism.

In this campaign, the malicious extension can reportedly inject a fake browser update message and provide operating-system-specific instructions directing the user to copy and paste a malicious command. This allows an attack that begins inside the browser extension to escape the browser environment and potentially execute code directly on the endpoint. That transition dramatically increases the possible impact because the attacker is no longer limited to browser data.

ClickFix also demonstrates how technical and social-engineering attacks increasingly blend together. The extension itself provides privileged access to the page and therefore creates a trusted-looking interface, while the final execution step relies on convincing the user to perform an action. Security controls that focus exclusively on malicious files may miss the attack because the user manually invokes a legitimate shell or scripting interpreter.

Organizations should therefore monitor suspicious command-line execution patterns, particularly PowerShell, Windows command shell, shell scripts and scripting interpreters launched immediately after browser activity. Clipboard-based commands containing encoded content, remote downloads or execution instructions should receive particular attention.

The campaign also reinforces the importance of extension permission analysis. Extensions requesting broad abilities such as reading and changing data on all websites effectively receive enormous visibility into browser activity. Users commonly approve these permissions because the browser presents them as part of the installation process and the extension appears useful. Permission fatigue does the rest. Humans have demonstrated a remarkable capacity to click “Allow” when a button stands between them and a minor convenience.

Browser stores should consequently consider stronger warnings when extensions expand their permissions after installation or change ownership. A utility that historically needed access only to screenshots should not suddenly gain unrestricted access to cryptocurrency websites and every form submission without meaningful review. Behavioral changes between versions can be as important as the permissions themselves.

Enterprises should implement extension allowlists rather than permitting employees to install arbitrary browser extensions. Approved extensions should be evaluated according to business need, publisher reputation, requested permissions and security history. Extensions that provide marginal convenience while requesting extensive browsing access should generally not be permitted on systems handling sensitive corporate information.

Extension inventory is equally important. Security teams should know which extensions are installed across managed browsers, which versions are running and what permissions they possess. Without centralized visibility, identifying whether any employee installed one of the 19 malicious extensions becomes an exercise in sending company-wide emails asking people to check their browser, which is not generally considered the pinnacle of endpoint management.

Chrome Enterprise and Microsoft Edge management policies can help organizations control extension installation centrally. Administrators can block unapproved extensions, force-install required corporate extensions and revoke known malicious identifiers. Browser security policies should therefore form part of endpoint-management baselines alongside antivirus, EDR and operating-system configuration.

Security teams discovering one of the malicious extensions should not simply uninstall it and consider the incident resolved. Because the extensions were capable of credential theft, wallet theft, history collection and arbitrary code injection, installation should be treated as a potential compromise event. Users should assume that credentials entered while the malicious version was active may have been exposed.

Relevant passwords should therefore be changed from a clean device, authentication sessions should be revoked where possible and cryptocurrency users should examine wallet and exchange activity carefully. If a recovery phrase was entered into any suspicious webpage or extension interface, the wallet should be considered compromised and remaining assets moved to a newly generated wallet using a trusted device and fresh recovery phrase.

Enterprise security teams should additionally examine authentication logs for accounts used from affected browsers. Suspicious sign-ins from unfamiliar locations, new devices, abnormal token usage and unexpected application access may indicate that stolen credentials have already been used. Password rotation alone may be insufficient if attackers obtained session cookies or refresh tokens, making session revocation important.

Endpoint investigation should look for activity associated with the ClickFix capability. Command shells, PowerShell executions, newly downloaded executables, scheduled tasks, startup entries and suspicious remote-access tools may indicate that the browser compromise progressed into operating-system compromise. A malicious extension can therefore become the initial access mechanism for a considerably larger endpoint incident.

Network telemetry may also provide useful evidence. Persistent WebSocket connections to unfamiliar infrastructure from browser processes should receive scrutiny, particularly where large numbers of endpoints suddenly communicate with the same unusual destination. The campaign's ability to rotate C2 servers means exact domain indicators may have limited lifespan, making behavioral detection valuable.

DNS monitoring can complement this approach. Newly registered domains, unusual hosting providers and domains contacted only by a small number of endpoints can represent useful signals. Browser traffic produces enormous amounts of legitimate noise, so correlation with installed extension data and endpoint telemetry is particularly important.

The extension-acquisition strategy raises another uncomfortable question for independent extension developers. Selling a browser extension is not equivalent to selling an ordinary piece of software because the purchaser may inherit automatic update access to an installed user population. The transaction can effectively transfer the ability to execute new browser code across tens of thousands of existing endpoints.

Browser marketplaces should therefore consider stronger security review following ownership transfers. A change in developer account, signing identity or payment ownership could trigger enhanced scrutiny of subsequent updates. Large-established extensions transferring to new owners deserve particularly careful inspection because their existing installation base represents immediate distribution infrastructure.

Users also need better visibility when ownership changes. If an extension installed two years ago is sold to another organization, users should not necessarily continue trusting it silently simply because the icon remains the same. Browser interfaces could notify users of significant publisher changes and provide an opportunity to reconsider whether the extension remains necessary.

The Superior campaign also demonstrates why reputation-based security can fail. A legitimate extension may accumulate positive reviews, download counts and years of benign history before becoming malicious. Security products that rely heavily on reputation may therefore continue treating the extension as trusted during the early stages of malicious activity.

Behavior-based monitoring is more resilient. An extension suddenly establishing persistent command connections, removing CSP headers, injecting scripts into cryptocurrency websites or accessing forms outside its normal purpose should appear suspicious regardless of its historical reputation.

The incident similarly challenges traditional software allowlisting. The browser itself is trusted, the extension may have been installed through an official marketplace and the extension identifier may have been approved months earlier. Yet malicious behavior can still appear after an update. Application control increasingly needs to consider version changes and behavior rather than simply whether software possesses an approved name.

Software supply-chain risk is usually discussed in relation to npm packages, Python libraries, container images and compromised build systems. Browser extensions deserve inclusion in the same discussion. Developers or owners distribute code automatically to a large population, users trust the update mechanism and attackers can compromise either the publisher or ownership of the project to distribute malicious code downstream.

In some respects, extensions are particularly attractive because they execute directly where users interact with sensitive websites. A compromised software package may require an application to rebuild and redeploy before malicious code reaches production. A compromised extension can potentially reach users immediately through browser auto-update.

The campaign's apparent duration since February 2024 also illustrates how long malicious extension operations can persist before their complete scope becomes visible. Individual extensions may be detected and removed while related extensions continue operating under different names and developer identities. Threat intelligence therefore needs to identify code similarities, infrastructure reuse and behavioral patterns rather than treating each extension as an unrelated incident.

Researchers reportedly connected the 19 extensions through shared code and tradecraft. This clustering approach is valuable because threat actors frequently reuse development frameworks across different products. Identifying the common loader, command protocol or injection techniques can expose an entire campaign rather than repeatedly discovering individual extensions one by one.

Organizations should similarly hunt for behavior associated with the campaign rather than limiting remediation exclusively to the known extension IDs. Additional related extensions may remain undiscovered. Extensions exhibiting unexpected WebSocket C2 communication, dynamic script loading or interference with Content Security Policy should be investigated even if their names do not yet appear on a published malicious-extension list.

The use of fake websites to promote some extensions demonstrates how official browser stores can be incorporated into phishing campaigns. Attackers create professional-looking websites advertising useful productivity, cryptocurrency or marketing tools and then direct victims toward the legitimate Chrome Web Store page. The official marketplace gives the installation process an additional layer of credibility.

This is another reason users should evaluate whether an extension is genuinely necessary rather than assuming Web Store availability equals security approval. Browser marketplaces conduct security screening, but the enormous number of extensions and the possibility of malicious updates mean no review mechanism can guarantee perpetual trustworthiness.

Crypto-focused users should be especially conservative. A browser extension that claims to provide wallet analysis, portfolio tracking or transaction functionality may naturally request access to cryptocurrency websites. Those permissions also give malicious software exactly the visibility required to manipulate transactions or steal wallet information. Users should minimize the number of extensions installed in browsers used for financial or cryptocurrency activities.

A dedicated browser profile containing no unnecessary extensions can significantly reduce exposure for sensitive transactions. High-value cryptocurrency users may go further by using a dedicated device for wallet administration rather than performing financial activity from the same browser used for general web browsing and extension experimentation.

Hardware-wallet transaction verification remains another important control. Users should verify destination addresses and amounts on the hardware device itself rather than trusting information displayed only inside the browser. A malicious extension may alter the destination address shown on a webpage, but a properly designed hardware wallet displays the actual transaction being signed.

The browser should therefore increasingly be treated as an operating environment rather than simply an application. Modern browsers execute powerful extensions, maintain authentication tokens, store credentials and provide access to virtually every cloud service an employee uses. Compromising the browser can therefore provide an attacker with access comparable to compromising parts of the operating system.

Enterprise cybersecurity architectures need to reflect this reality. Browser telemetry, extension management, URL filtering, credential protection and session monitoring should form part of endpoint security strategy. EDR alone may not observe every malicious action occurring inside browser extension contexts.

Zero Trust strategies should also consider browser state. Authentication decisions based solely on a valid username, password and MFA challenge may still permit access from a browser containing a malicious extension capable of observing or manipulating the authenticated session. Device posture and managed-browser controls can provide additional assurance.

The campaign also demonstrates the increasing importance of session security. Attackers do not always need passwords if they can steal authenticated browser tokens. Services should monitor session behavior, bind sessions to appropriate device context where practical and support rapid revocation. High-risk account changes should require fresh authentication rather than relying indefinitely on an existing browser session.

For organizations with cryptocurrency exposure, browser-extension controls should be particularly stringent around finance and treasury personnel. A malicious wallet-focused extension installed on a workstation handling corporate digital assets could have consequences dramatically larger than compromise of an ordinary employee account.

The broader lesson from the Superior campaign is that the software supply chain does not stop at the application installer. Anything capable of receiving trusted automatic updates can become a supply-chain distribution mechanism. Browser extensions are particularly powerful examples because they combine automatic updates, privileged access to web content and strong user trust.

The five extensions purchased from legitimate developers demonstrate the weakness especially clearly. The users did not necessarily make a bad security decision. They may have researched the extension, installed something legitimate and used it safely for months. The security condition changed later when ownership changed and malicious functionality arrived automatically.

That means security programs need continuous trust evaluation rather than one-time approval. An extension approved today should remain subject to monitoring tomorrow. Changes in ownership, permissions, network behavior and update contents can all alter the risk.

The campaign is also another reminder that convenience software deserves scrutiny proportional to its privileges rather than its apparent importance. A utility that simply enables right-clicking on websites may appear harmless, but if it requests permission to inspect or modify every page the user visits, the security implications are enormous compared with the trivial function it provides.

A useful rule is therefore to compare requested privileges with expected functionality. An extension designed to modify one specific website should not normally require universal access. An OCR tool should not need persistent command-and-control communication. A cryptocurrency price ticker should not require the ability to modify wallet transaction pages.

The security industry's long-standing advice to install extensions only from official stores remains useful, but the Superior campaign shows that it is no longer sufficient. Users should install as few extensions as possible, remove those no longer needed and periodically review permissions. Enterprises should replace voluntary hygiene with centralized enforcement wherever sensitive information is involved.

Most importantly, discovery of a malicious extension should be treated as a credential and session exposure event rather than merely unwanted software. The extension has been operating inside the browser's trust environment and may have observed activity long before detection. Removing it stops future activity but cannot undo information already transmitted to the attacker.

The Superior campaign ultimately demonstrates an uncomfortable weakness in browser security: automatic updates are built around continuity of developer trust. When the developer becomes malicious, is compromised or sells the extension to someone malicious, the mechanism designed to keep users secure becomes the mechanism that silently compromises them.

That is not an argument against automatic updates. Without them, millions of users would continue running known vulnerable software indefinitely, because apparently clicking “update” once a month represents an intolerable administrative burden for civilization. The real lesson is that browser marketplaces and enterprises need stronger monitoring of what changes during those updates.

Security should therefore focus not only on whether an extension came from a trusted marketplace, but whether its present behavior still matches the reason it was originally trusted. If an extension installed to copy text suddenly begins stripping CSP headers, maintaining WebSocket connections, injecting JavaScript into cryptocurrency sites and collecting authentication forms, its historical reputation should become irrelevant very quickly.

The 19-extension Superior campaign shows how effectively attackers can weaponize accumulated trust. They can create legitimate-looking applications, wait for users to arrive, purchase established extensions and then allow normal browser-update mechanisms to deliver malicious functionality at scale. For defenders, the answer is not to abandon extensions entirely but to recognize that every extension is executable code operating inside one of the most sensitive applications on the endpoint.

In modern enterprises, the browser has effectively become the workspace, identity portal, banking terminal, collaboration platform and cloud-management console simultaneously. Giving an extension broad access to that environment deserves considerably more scrutiny than clicking “Add to Chrome” currently suggests.

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share similarities in code and tradecraft, with evidence indicating that the campaign may have been active

Source: 19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code via The Hacker News — published 28 Aug 2026.