A sophisticated browser-extension campaign has turned seemingly useful Chrome and Microsoft Edge add-ons into a delivery system for cryptocurrency theft, credential harvesting, browser surveillance and social-engineering attacks, potentially exposing tens of thousands of users.
Security researchers identified 19 extensions connected to the operation, consisting of 18 Chrome extensions and one Microsoft Edge extension.
The malicious framework behind the extensions is designed to be modular, allowing attackers to remotely deploy different types of JavaScript payloads depending on what they want to steal from an infected user.
Cryptocurrency appears to be the operation’s primary focus.
Researchers observed capabilities for draining multiple types of crypto wallets, stealing hardware-wallet recovery phrases, gathering cryptocurrency exchange account information and hijacking legitimate wallet interactions.
But the operation extends considerably beyond digital assets.
The extensions could also capture passwords and information entered into website forms, collect authenticated session tokens, gather Facebook and LinkedIn account data, steal browsing history and display fake browser-update messages designed to convince victims to execute malicious commands on their computers.
Application-security company Socket uncovered the latest collection of extensions and tracks the broader campaign under the name “Superior.”
Although the malicious versions identified in the current investigation appeared during the past six months, similarities in programming techniques, infrastructure and domain names connect the activity with attacks dating back to at least February 2024.
Earlier research from other cybersecurity investigators documented related techniques, suggesting the operation has continued evolving for more than two years.
One of the most concerning aspects of the campaign is how some of the attackers obtained access to users.
Rather than creating every extension from scratch, the operators purchased legitimate browser extensions from their original developers.
Five of the 19 identified extensions had previously been legitimate products.
After acquiring them, the attackers issued new versions containing malicious functionality.
That strategy allows an attacker to inherit an already-established user base rather than convincing thousands of people to install a suspicious new extension.
It is particularly dangerous because Chrome normally updates installed extensions automatically.
An individual who legitimately installed an extension months or even years earlier could therefore receive a malicious version later without intentionally installing another product.
Users also are not necessarily alerted simply because ownership of an extension changes.
The largest potential exposure involved an extension called Enable Right Click & Copy — Smart Unlock + OCR.
The extension was originally developed by PreppHint and was designed to restore functions such as copying text and using the right-click menu on websites that restricted those actions.
It had approximately 70,000 Chrome users when malicious functionality was introduced after the extension changed hands.
A corresponding Microsoft Edge version carrying the same malware had about 10,000 users.
That created a combined potential exposure of roughly 80,000 people, although researchers stressed that the number does not prove all 80,000 users actually received or ran the malicious release.
Google removed the Chrome version after it was identified as harmful.
At the time of Socket’s investigation, however, the Microsoft Edge version remained available and was continuing to serve malicious code.
Researchers reported the Edge extension to Microsoft.
The operators also demonstrated their ability to adapt quickly.
Initially, the Chrome and Edge editions communicated with the same command-and-control infrastructure.
After the Chrome extension was detected and removed, the attackers issued another Edge update on August 14 using a different command-and-control domain.
That behavior fits the broader architecture of the malware, which was designed to survive infrastructure disruptions.
Once one of the compromised extensions becomes active, its background service worker establishes communication with attacker-controlled servers.
Newer versions maintain a persistent WebSocket connection, allowing the remote infrastructure to communicate with the infected browser.
The extensions store configuration information locally, including a unique identifier for the installation, connection information, activity details and downloaded malware modules.
Messages coming from the command-and-control servers can contain JavaScript payloads that are encrypted and stored inside the browser extension’s local storage.
Researchers found that the malware uses AES-GCM encryption, with its encryption key derived from information including the extension identifier and the installation’s unique ID.
The command-and-control design also supports server rotation.
An initial server can instruct an infected extension to begin communicating with different infrastructure.
Separate endpoints can be assigned for stolen-data collection and additional malware delivery.
That structure makes the operation more resilient because taking down one server does not necessarily disable infected extensions.
The malware also attacks security protections built into websites.
Modern sites frequently use Content Security Policy headers to limit the types of code that can execute inside a page and to help prevent unauthorized script injection.
The malicious extensions remove several of those protections from websites the victim visits.
That includes standard Content Security Policy headers as well as related CSP headers.
Once those defenses are removed, the extension can inject attacker-controlled JavaScript into webpages.
Older versions of the malicious code automatically loaded content scripts through broad wildcard rules covering webpages.
Newer versions moved toward dynamic injection techniques that are potentially less obvious.
The malware can create hidden webpage elements, including invisible input fields, forms and images.
Malicious JavaScript is attached to events associated with those hidden elements.
The extension then triggers the event, causing the attacker’s code to execute in the webpage’s normal JavaScript environment before removing the temporary element to reduce evidence of what happened.
The modular design means the underlying extension primarily functions as a malware delivery framework.
Researchers observed 16 individual malicious modules during analysis, grouped into several major categories.
One of the most dangerous is a multi-chain cryptocurrency wallet drainer.
The malware can recognize wallets associated with Ethereum-compatible networks, Solana and Tron.
After detecting a relevant environment, it can retrieve another attack stage from dedicated infrastructure.
The malware then targets legitimate cryptocurrency controls on webpages, including Connect Wallet and Swap buttons.
Rather than simply creating an obvious fake button somewhere else on the page, the malware can interfere with the real interface.
It clones legitimate buttons, removes the website’s original event handlers and replaces them with attacker-controlled behavior.
The real wallet interaction can be dismissed while the malicious version guides the victim through connection or authorization steps that ultimately give the attackers the ability to steal cryptocurrency.
Hardware-wallet owners are another major target.
Specialized modules attack visitors to the official Ledger and Trezor websites.
The malware can replace the legitimate page with a highly convincing imitation of Ledger Live or a Trezor recovery and update process.
Victims are guided through a fake restoration procedure and asked to provide their cryptocurrency recovery phrase.
The phishing interface supports 12-word, 18-word and 24-word seed phrases.
Those words can then be transmitted to the attackers.
A recovery phrase effectively represents control over the underlying cryptocurrency wallet, meaning anyone who obtains it can potentially recreate the wallet elsewhere and transfer its assets.
Another collection of modules specifically targets cryptocurrency exchanges and wallet services.
Researchers found code aimed at OKX, MEXC, Kraken, KuCoin, Coinbase, Binance, Bybit and MetaMask.
The malware does not necessarily need users to type their exchange passwords again.
Because the victim may already be logged in, it can extract information from authenticated browser sessions.
That can include session cookies, bearer or authorization tokens, balances, profile information and other account data.
Such information provides attackers with insight into how much cryptocurrency a victim controls and, depending on the stolen session material and the target’s security controls, could potentially contribute to account takeover.
The campaign also includes a much broader credential-stealing component.
A universal form-grabbing module monitors input fields across websites.
It can watch focus, input, change, blur and other webpage events associated with text fields, email fields and password boxes.
That means its targets are not limited to cryptocurrency websites.
Information typed into other websites can also be captured.
The malware collects the values users enter, groups stolen information into batches and periodically sends it to attacker infrastructure along with information identifying the webpage and environment where the data was obtained.
Its surveillance capabilities extend into social media.
A module targeting Facebook attempts to collect access tokens as well as business, billing and professional-dashboard information.
LinkedIn users face a different technique.
The malware can register a rogue service worker inside a LinkedIn session and interfere with anti-cross-site request forgery protections, helping the attackers misuse an already-authenticated account.
Another dedicated module gathers a victim’s browser history.
That can provide attackers with a detailed picture of which websites an infected user visits, potentially revealing financial services, employers, cryptocurrency platforms, social-media accounts and other targets for future attacks.
The malware can also launch ClickFix-style social-engineering attacks.
ClickFix attacks typically present a victim with a fake technical problem or update and then provide instructions that ultimately lead the victim to execute attacker-controlled code themselves.
In this campaign, the browser extensions can inject fake Chrome update interfaces into webpages.
The malicious content may appear as an update page, banner, modal window or similar warning.
One version displays a convincing Chrome message claiming an update is available.
An attacker-controlled command is secretly placed into the victim’s clipboard.
The victim then sees operating-system-specific instructions telling them how to paste and execute that command.
The result can move the attack beyond the browser extension itself by convincing a person to run malicious commands directly on the operating system.
The attack infrastructure includes domains used for several different purposes.
Researchers identified dedicated command-and-control servers, Cloudflare Worker addresses used for stolen-data collection, domains that delivered cryptocurrency wallet-draining code and infrastructure used to host the fake browser-update pages.
Socket believes the architecture is intentionally designed so that different components can be replaced over time.
The list of observed malware modules therefore should not be viewed as permanent or complete.
Because the attacker can push additional JavaScript from remote servers, new capabilities could be added without fundamentally rebuilding the browser extension.
Researchers expect the malware to continue changing.
The 19 identified extensions span several categories that ordinarily appear harmless, including screen-search utilities, PDF tools, SEO services, cryptocurrency price trackers, advertising research tools and website-traffic analyzers.
Five were legitimate extensions later acquired by the attacker.
Those were Enable Right Click & Copy — Smart Unlock + OCR, RapidLens – Google Lens for Screen Search & Images, QuickLens – Search Screen with Google Lens, Password Protect PDF, and the Microsoft Edge extension Allow Copy – Select & Enable Right Click.
The remaining 14 were created by the threat actor before later receiving malicious updates.
They were PixelCheck; Creative Library – Ad Spy Tool; Website Traffic Checker: MirrorSphere SEO Stats; Site Signal – Website Traffic & SEO Checker; SEO Pulse Pro – Website Traffic & SEO Analyzer; Private Crypto News Reader; Blockfolio: Address Monitor; Crypto Rates & Fiat Converter; Crypto Alerter: Price Alarms & Volatility Warnings; DeFi Pulse Tracker; Crypto Price Badge: Quick Glance; Multi-Chain Explorer; LedgerLook: Wallet Checker; and Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Ray.
Researchers said all of the identified extensions followed a similar publishing strategy.
Their first versions delivered the advertised functionality and did not contain the malicious framework.
Later releases introduced the malware after the extensions had gained some level of legitimacy or user trust.
That method reduces suspicion compared with launching an obviously malicious extension immediately.
The campaign’s connection to activity going back to 2024 was established partly through similarities with infrastructure identified in previous research.
Investigators noted repeated use of .top domains and similar naming patterns for servers associated with wallet-draining scripts.
Socket considers the group behind the operation technically capable and persistent.
Researchers believe separating the malware-loading framework from the individual attack modules helps the operators avoid detection.
The framework itself can remain relatively consistent while the payload delivered to a particular target changes.
The ability to redirect infections to new command-and-control systems, use separate channels for stolen information and dynamically retrieve new payloads further increases the campaign’s resilience.
The economics of acquiring legitimate extensions may also encourage attackers to continue using the strategy.
Researchers noted that a browser extension with around 10,000 existing users can sometimes be purchased for less than $2,000.
For an attacker attempting to steal cryptocurrency or large numbers of credentials, purchasing an established extension can therefore provide an inexpensive way to immediately reach thousands of potential victims.
At the time the security report was published, none of the identified malicious extensions remained available through Google’s Chrome Web Store.
Users who previously installed one of the affected products should not assume removal from the store automatically eliminates the consequences of an earlier infection.
Anyone who had one of the extensions installed should remove it if it remains present and treat credentials entered while the malicious version may have been active as potentially exposed.
Passwords associated with affected sessions should be changed, particularly for financial, email and other sensitive accounts.
Users should also invalidate active sessions where possible and enable multifactor authentication to make stolen passwords or session information less useful.
The risk is even greater for cryptocurrency users.
Anyone who may have entered a Ledger or Trezor recovery phrase into a fake page should consider that seed phrase compromised.
Because changing an account password cannot invalidate a cryptocurrency seed phrase, affected assets should be transferred to an entirely new wallet generated with a new recovery phrase.
Users whose browser may have been exposed to the wallet-draining modules should likewise consider moving cryptocurrency to a new wallet rather than continuing to trust potentially compromised credentials.
The discovery also highlights a larger weakness in the browser-extension ecosystem.
An extension can be legitimate when a person installs it and become dangerous months later after being sold or compromised.
Automatic updates, normally an important security feature because they quickly distribute fixes, can then become the mechanism that delivers malware to users who previously trusted the software.
The Superior campaign demonstrates that checking whether an extension is legitimate only at the moment of installation may no longer be enough.
For users, regularly reviewing installed browser extensions, uninstalling add-ons that are no longer necessary and treating unexpected wallet prompts or browser-update messages with suspicion can substantially reduce exposure.
For cryptocurrency holders in particular, the case is another reminder that a compromised browser can undermine even sophisticated security tools.
A hardware wallet can protect private keys from ordinary malware, but it cannot protect a user who is tricked into voluntarily entering the wallet’s recovery phrase into a convincing phishing page.
The attackers behind this campaign appear to understand that distinction well.
By combining established browser extensions, remote malware delivery, cryptocurrency-specific attack tools and broad credential theft into one modular framework, they created an operation capable of targeting both digital assets and nearly everything else a victim does inside the browser.