Security researchers have uncovered 19 malicious Chrome and Edge extensions delivering cryptocurrency wallet drainers, credential stealers, session hijacking tools, and other remotely loaded malware.
Socket Threat Research reports that the malicious versions appeared over the past six months, but code and infrastructure similarities link the activity to a campaign dating back to at least February 2024.
Socket tracks the operation as Superior, based on names found in its malicious JavaScript modules.
The attackers published clean extensions first, then added malware after building user trust. Socket identified 14 extensions created by the threat actors and five that were acquired from legitimate developers.
The most notable case is Enable Right Click & Copy — Smart Unlock + OCR, originally developed by PreppHint before being acquired. Its Chrome version had around 70,000 users when malicious code was introduced, while the Edge version had about 10,000 users.
Socket
Google removed the Chrome version after detecting it as malicious. At the time of Socket's report, the Edge version was still active and serving malware, and had switched to a new command-and-control domain in an update published on August 14.
The extensions use background service workers to establish persistent WebSocket connections with attacker-controlled servers. These servers can send encrypted JavaScript modules that are stored locally and executed on demand.
The framework can also rotate command-and-control servers and assign separate exfiltration endpoints, making the operation harder to disrupt.
Before injecting malicious code, the extensions strip Content Security Policy headers from websites using Chrome's declarativeNetRequest API. This weakens protections designed to prevent unauthorized script execution.
The malware then injects JavaScript into visited pages through hidden HTML elements and event handlers, allowing payloads to execute inside the webpage's main context.
Socket observed 16 malicious modules in one compromised extension. Their capabilities include a multi-chain wallet drainer targeting EVM, Solana, and Tron wallets, as well as fake Ledger and Trezor recovery pages designed to steal 12-, 18-, or 24-word seed phrases.
Other modules target authenticated sessions on Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, and MetaMask, collecting cookies, authorization tokens, account information, and balances.
A general-purpose module named superior-grabber monitors password, email, and text fields across websites and exfiltrates entered data.
The campaign also includes modules for stealing Facebook access tokens and business data, abusing LinkedIn sessions, extracting browsing history, and displaying ClickFix-style fake browser update prompts that instruct victims to run attacker-supplied commands.
Socket linked the campaign to earlier DomainTools research through shared techniques and similar infrastructure.
Chrome and Edge users should review installed extensions regularly, remove unnecessary add-ons, and revoke sessions or change passwords if they used sensitive accounts while a suspicious extension was installed. Cryptocurrency users who entered a recovery phrase into a browser prompt should treat that wallet as compromised and move funds to a newly generated wallet.
Buying established extensions gives attackers immediate access to large user bases, while automatic browser updates allow malicious versions to spread without users reinstalling anything, so monitoring for ownership changes is crucial.
Leave a Reply