Loading story…
Researchers uncovered the Superior campaign, in which attackers distributed 18 malicious Chrome extensions and one Microsoft Edge extension that stole cryptocurrency-wallet secrets, credentials, browser data, and social-media sessions. The operator reportedly acquired legitimate extensions—or first published benign versions—then used automatic extension updates to install a modular malware framework after building an install base; the activity may have begun in early 2024.
The extensions used encrypted persistent WebSocket connections for command-and-control, received rotatable infrastructure endpoints, removed page Content Security Policy headers, and injected malicious scripts into sites victims visited. Modules supported wallet draining, seed-phrase phishing, exchange-session theft, form and credential capture, browser-history collection, and ClickFix-style fake-update lures. Google removed the identified Chrome extensions, but an affected Edge extension remained available at reporting time; users should remove affected extensions, change passwords, revoke active sessions, and move cryptocurrency to newly created wallets.
Trace attribution and downstream blast radius.
9 events from the most recent confirmed update back to the earliest known activity.
DomainTools Investigations documented aspects of the activity associated with the campaign.
Socket assessed that the Superior malicious browser-extension operation may have been active since February 2024, using extensions that appeared legitimate before malicious functionality was introduced.
During Socket's investigation, the operators of the malicious Microsoft Edge version of Enable Right Click & Copy — Smart Unlock + OCR changed the malware's command-and-control domain. The source does not specify when the change occurred.
Researchers identified Superior's primary and secondary command-and-control domains, including lucky-random[.]sbs, along with Cloudflare Worker exfiltration sinks pipi[.]saghirmohamed19[.]workers[.]dev and mimi[.]saghirmohamed19[.]workers[.]dev. Wallet-drainer payloads were hosted at cookie-whitelist[.]top and whale-alert[.]art, while ggle-analytics[.]com hosted a fake browser-update lure.
The malicious Enable Right Click & Copy + Smart Unlock + OCR extension was removed from the Edge extension store, in addition to the previously reported Chrome Web Store removals. Devices where it remains installed are still potentially compromised until users manually remove it.
Google removed the identified malicious extensions from the Chrome Web Store. At the time of Socket's report, the Edge version of Enable Right Click & Copy — Smart Unlock + OCR remained available in the Edge add-ons store.
Analysis found modules that drained EVM, Solana, and Tron wallets; phished Ledger and Trezor seed phrases; stole wallet and exchange sessions; captured credentials and form data; collected social-media data and browsing histories; and delivered ClickFix-style fake update lures.
Socket identified Superior as a cluster of 18 malicious Chrome extensions and one Edge extension using an extensible framework with 16 modules. The framework used encrypted persistent WebSocket C2 connections, rotating endpoints, CSP-header removal, and injected scripts to deploy additional malicious functionality.
The unidentified actor created 14 identified extensions and acquired five from prior owners, then used automatic browser-extension updates to introduce malicious code after extensions had established users. One acquired cross-browser extension, Enable Right Click & Copy — Smart Unlock + OCR, had about 80,000 combined Chrome and Edge installs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
10 references tracked. Mallory keeps watching after this page renders.
ghacks.net
Open sourcexakep.ru
Open sourcetrojan-killer.net
Open sourcecyberveille.ch
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a browser-extension campaign involving **19 malicious Chrome and Microsoft Edge extensions**, including 14 published as apparently legitimate tools and five acquired from their original developers before receiving malicious updates. The extensions, reportedly installed by as many as **2.3 million users**, contact attacker-controlled command-and-control infrastructure, retrieve replaceable modules, bypass Content Security Policy protections, and inject code into pages opened by targeted victims. The extensions can exfiltrate browsing histories, credentials, payment data, Facebook and LinkedIn information, cryptocurrency assets, and hardware-wallet seed phrases. They also report visited URLs to attacker APIs and can redirect tabs to server-selected destinations for phishing and session theft; observed infrastructure includes `ebmitab[.]com`, `abmitab[.]com`, and `addmitab[.]com`. Some extensions replace pages with fake browser-update prompts that use **ClickFix** social engineering to induce victims to run malicious commands, extending compromise beyond the browser. Organizations should allowlist extensions, remove affected add-ons, and reset potentially exposed credentials and sessions.
Sep 20, 2026
Researchers uncovered multiple browser-extension campaigns that abused clipboard access to steal sensitive data and cryptocurrency. Socket found that Chrome and Firefox extensions branded as **VPN Go: Free VPN** initially behaved like legitimate proxy tools before later updates added clipboard monitoring, data chunking, session tagging, and HTTP exfiltration to hardcoded attacker-controlled IP addresses. The Chrome extension turned malicious in version `1.1`, while the Firefox add-on first did so in version `1.3.3`, indicating a staged update strategy designed to retain users while covert theft ran in parallel. A separate campaign tracked as **Silent Swap** used unsigned installers to deploy a fake **Google Notes** Chromium extension that replaced copied wallet addresses with attacker-controlled ones, enabling cryptocurrency theft across multiple coins. McAfee said the malware modified Chromium preference files and recalculated integrity values to avoid detection, while using **EtherHiding** and blockchain-based dead-drop resolution to fetch command-and-control details; the activity also overlaps with **CountLoader**, suggesting a shared operator. Google and Mozilla were notified about the malicious VPN-themed extensions, and users who copied passwords, wallet addresses, or other secrets while the add-ons were installed are advised to treat that data as compromised.
Jun 30, 2026
Researchers uncovered a long-running Firefox extension campaign, dubbed **Offside Wallet Theft Factory**, that used dozens of linked add-ons to steal cryptocurrency wallet seed phrases and browser credentials. The operation had been active since at least March 2026 and involved **77 related extensions**, with **40 confirmed as malicious**. The add-ons impersonated legitimate Web3 and wallet tools, targeting users seeking browser-based cryptocurrency functionality. One extension highlighted by researchers, **`0KX WEB3`**, presented itself as a crypto wallet but lacked real wallet features. Instead, it queried a **Supabase-hosted database** that allowed the operators to remotely change the extension from a benign-looking decoy into a phishing interface designed to capture wallet import secrets and passwords. The findings show that even extensions requesting limited permissions can still be weaponized, and that clusters of seemingly harmless add-ons sharing code or infrastructure may later be updated into credential- and wallet-stealing malware.
Aug 27, 2026