19 Chrome, Edge Extensions Found Stealing Crypto Wallets, Data

Superior is the name Socket security researcher Karlo Zanki gave to a cluster of 19 browser extensions, 18 for Chrome and one for Microsoft Edge, that carry a shared wallet-stealing and crypto-draining framework. The extensions were reported to have been published over roughly the last six months, though evidence points to activity dating back to February 2024. Of the 19, 14 were built from scratch by the threat actor under innocuous names like PixelCheck and Website Traffic Checker, while five were bought from developers who had already published legitimate, functioning tools.

The acquired extensions are the harder case for defenders. Socket says the attacker either buys a working extension outright or ships a clean version first, waits for it to accumulate installs, then pushes an update carrying the malicious payload. "Enable Right Click & Copy, Smart Unlock + OCR" illustrates the pattern: it reached roughly 70,000 Chrome users and 10,000 Edge users, per BleepingComputer's review of Socket's report, before its update turned malicious.

Once installed, the malicious code opens a persistent, encrypted WebSocket connection to a command-and-control server and downloads JavaScript modules on demand. Zanki told The Hacker News that the loading framework supports rotating the C2 endpoint and the data-exfiltration destination based on server-issued instructions, a design that spreads victims across different infrastructure groups and lowers detection risk per victim.

The framework strips Content Security Policy headers from every page a victim visits, then injects content-script modules through hidden HTML elements. Socket catalogued 16 distinct modules spanning multi-chain wallet drainers for EVM, Solana and Tron wallets; a hardware-wallet seed-phrase harvester that mimics Ledger and Trezor recovery pages; session and credential harvesters targeting Binance, Coinbase, Kraken, OKX, MEXC, KuCoin, Bybit and MetaMask; a universal form grabber; Facebook and LinkedIn account stealers; a browser history exfiltrator; and a ClickFix-style lure that displays a fake browser-update prompt instructing victims to paste an attacker-supplied command.

• Wallet drainer hijacks legitimate "Connect Wallet" and "Swap" buttons on DeFi sites to redirect transactions.
• Fake Ledger/Trezor pages solicit seed phrases directly from victims.
• Exchange harvester targets sessions and account data on seven named platforms plus MetaMask.
• ClickFix module tailors OS-specific fake update instructions to get victims to run a malicious command.

Anyone who installed one of the 19 named extensions on Chrome or Edge is potentially affected, regardless of whether the extension looked like a productivity tool, an SEO checker, or a crypto tracker. The list spans categories designed to attract different audiences: OCR and clipboard utilities, ad-spy and SEO analysis tools, PDF password protection, and multiple standalone crypto price trackers and wallet monitors. That range may suggest the operator cast a wide net rather than targeting crypto users exclusively through obviously crypto-branded add-ons, though the operator's precise targeting strategy is not confirmed.

The single largest exposure by install count is "Enable Right Click & Copy, Smart Unlock + OCR," with a combined Chrome and Edge user base cited by Socket at roughly 80,000. BleepingComputer's review of the same report put the split at about 70,000 Chrome installs and 10,000 Edge installs. Both figures come from Socket's disclosure rather than store-verified counts at time of writing.

BleepingComputer reported that Google removed the malicious extensions from the Chrome Web Store, and none of the 19 were available there at the time of its publishing. The Microsoft Edge version of "Enable Right Click & Copy, Smart Unlock + OCR," however, remained available on the Edge Add-ons store when Socket published its findings, with no confirmation yet on when or whether Microsoft plans to remove it. Neither Google nor Microsoft is quoted directly in the available reporting on this specific cluster.

Socket's findings build on earlier reporting. "QuickLens - Search Screen with Google Lens," one of the 19 extensions, was previously flagged separately by Annex Security and monxresearch-sec earlier in 2026 for pushing malware to downstream users, injecting arbitrary code, and harvesting sensitive data. Socket says its own investigation shows the campaign is broader than those earlier reports suggested.

DomainTools Investigations documented related activity in May 2025, describing the same threat actor building fake websites that impersonated productivity tools, ad and media analysis assistants, VPN services, and crypto or banking utilities to steer users toward installing the malicious extensions from the Chrome Web Store. DomainTools noted the extensions "generally appear to function as intended, but also connect to malicious servers to send user data, receive commands, and execute arbitrary code." Zanki argues that more than two years of sustained operation points to a well-resourced, capable threat actor whose identity remains unknown.

Socket's core recommendation is to audit installed browser extensions regularly and remove anything unused or unrecognized, since accumulated, forgotten extensions are exactly the low-attention surface this campaign exploits. Zanki singled out Chrome's default auto-update behavior as the mechanism that let acquired extensions reach large install bases with a malicious update, without any action from the user.

• Check installed extensions against the 19 IDs named in Socket's report and remove any matches immediately.
• Treat any credentials entered while a listed extension was active as compromised and change passwords.
• Move cryptocurrency holdings to a newly created wallet rather than reusing a potentially exposed one.
• Never enter a hardware-wallet seed phrase into a browser tab; legitimate Ledger and Trezor recovery flows do not work that way.
• Treat unexpected in-browser update prompts as suspicious rather than clicking through them.

Anyone who installed one of the 19 extensions should treat stored credentials and crypto wallets as exposed, since the framework combines session theft with active wallet-draining modules.

Security: CSP stripping removes a core browser-level script-injection defense, letting the framework run arbitrary code on any site the victim visits, not just crypto platforms.

Privacy: Modules exfiltrate browser history, form entries, and Facebook/LinkedIn account data in addition to financial credentials, per Socket's findings.

Socket disclosed 19 Chrome and Edge extensions running a shared malware framework, dubbed Superior, that drains crypto wallets and steals exchange and social media credentials since roughly February 2024.