19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto
Socket found 19 malicious Chrome and Edge extensions, active since February 2024, stealing wallet seed phrases and credentials and draining crypto from about 80,000 users.
Socket researcher Karlo Zanki documented a cluster of 18 Chrome and one Edge extensions with wallet secret stealing and cryptocurrency draining capabilities, tracked as campaign Superior and possibly active since February 2024. The actor created 14 extensions and bought five legitimate ones, later pushing malicious updates; the largest, Enable Right Click & Copy, has roughly 80,000 installs across both browsers. The extensions maintain WebSocket C2 connections with endpoint rotation, strip CSP headers, and load 16 modules including multi-chain wallet drainers, hardware-wallet seed-phrase harvesters, credential grabbers, and ClickFix-style lures.
- 14 extensions were created by the threat actor; 5 were bought from prior owners then updated with malware.
- Extensions maintain WebSocket C2 with endpoint rotation and per-victim exfiltration channels.
- 16 modules include multi-chain wallet drainers, seed-phrase harvesters, and Facebook/LinkedIn account stealers.
- ClickFix module injects fake browser updates and tricks users into running pasted commands.
- ATT&CK
- T1176 Browser ExtensionsT1555.003 Credentials from Web BrowsersT1071.001 Web ProtocolsT1204.002 Malicious File
- Vendors
- SocketDomainTools
- Products
- Chrome Web Store
- Threat actors
- Superior
From the original article
4 min read at thehackernews.com
Ravie Lakshmanan Aug 28, 2026 Web Security / Supply Chain Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.