Superior Browser Extensions Stole Crypto Wallets, Credentials and Browser Data

Researchers uncovered the Superior campaign, in which attackers distributed 18 malicious Chrome extensions and one Microsoft Edge extension that stole cryptocurrency-wallet secrets, credentials, browser data, and social-media sessions. The operator reportedly acquired legitimate extensions—or first published benign versions—then used automatic extension updates to install a modular malware framework after building an install base; the activity may have begun in early 2024.

The extensions used encrypted persistent WebSocket connections for command-and-control, received rotatable infrastructure endpoints, removed page Content Security Policy headers, and injected malicious scripts into sites victims visited. Modules supported wallet draining, seed-phrase phishing, exchange-session theft, form and credential capture, browser-history collection, and ClickFix-style fake-update lures. Google removed the identified Chrome extensions, but an affected Edge extension remained available at reporting time; users should remove affected extensions, change passwords, revoke active sessions, and move cryptocurrency to newly created wallets.