Full research report

Chrome Web Store extensions caught stealing crypto, browser data

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

The Superior campaign is notable for its extension acquisition tactic: purchasing legitimate, well-reviewed extensions with established user bases removes the primary trust barrier that normally protects users from malicious add-ons, since victims and browser security reviews both assume continuity of a previously benign tool. The modular WebSocket C2 architecture — where the extension itself contains minimal malicious logic and pulls live JavaScript payloads post-installation — significantly complicates static analysis of submitted extensions and allows the operator to swap targeting in real time without a new store submission. The CSP stripping via declarativeNetRequest is particularly impactful because it neutralises a browser-level defence that would otherwise block injected scripts from running on high-value financial sites. The Cloudflare Workers exfiltration layer adds a further layer of network-level concealment, as outbound traffic blends with legitimate CDN usage. The two-year operational duration, corroborated across Socket, DomainTools, and Annex Security research, indicates a capable and patient operator who has progressively escalated from credential theft toward direct cryptocurrency draining — a trajectory consistent with financially motivated actors targeting the highest-yield browser sessions.

What happened

Socket researcher Karlo Zanki disclosed a campaign, internally named Superior, in which 19 malicious browser extensions — 18 for Chrome, one for Edge — delivered a modular malware framework capable of draining cryptocurrency wallets, phishing hardware-wallet seed phrases, stealing exchange session tokens, and harvesting social media credentials. Five of the extensions were legitimate tools purchased from their original developers and weaponised via Chrome's automatic update mechanism; 14 were purpose-built by the threat actor. Google removed the Chrome Web Store listings following Socket's disclosure, but the Edge Add-ons variant of at least one extension remained publicly accessible at the time of publication. Evidence from DomainTools links the actor's infrastructure pattern to activity observed from at least February 2024, making this a sustained operation of over two years.

Affected scope

Approximately 80,000 combined Chrome and Edge users at peak; 70,000 Chrome and 10,000 Edge installs confirmed for the single most-installed extension ('Enable Right Click & Copy — Smart Unlock + OCR'). Targeted sectors include retail cryptocurrency traders and investors using browser-based exchange interfaces (Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, MetaMask) and hardware wallet users (Ledger, Trezor). Secondary targets include Facebook business account holders and LinkedIn users. The true installed base across all 19 extensions is not yet published.

Technical assessment

Once installed, each extension establishes a persistent WebSocket connection to a C2 server, authenticated with a per-victim AES-GCM key derived from the extension ID and a unique install UUID. Extensions use the declarativeNetRequest API to strip Content Security Policy headers from every page the victim visits, removing a key browser defence against script injection. Nineteen modular JavaScript payloads are then pushed on demand via the C2 channel and executed in the page's main world context through chrome.scripting.executeScript, bypassing the extension's own content-script sandbox. This architecture allows the wallet-drainer module to hijack legitimate 'Connect Wallet' and 'Swap' UI elements without alerting the victim, while a separate module replaces Ledger and Trezor web interfaces with pixel-accurate phishing pages to harvest seed phrases. Secondary data exfiltration runs through Cloudflare Workers infrastructure, separating C2 command traffic from stolen credential delivery. The extension acquisition tactic — buying established tools with existing trust and user bases — circumvents the initial suspicion that accompanies a newly published extension.

Recommended defensive actions

  1. Audit all installed Chrome and Edge extensions immediately and remove any of the 19 identified extensions by ID (full list published in Socket's advisory).
  2. Check for and remove the 'Enable Right Click & Copy — Smart Unlock + OCR' extension specifically, as it reached the largest user base (80,000 installs); revoke any active web sessions on cryptocurrency exchanges and social platforms if it was installed.
  3. Block network connections to identified C2 and exfiltration domains at the DNS or proxy layer, including active-enable-right-click[.]top, password-protect-pdf[.]com, saghirmohamed19[.]workers[.]dev infrastructure, and ggle-analytics[.]com.
  4. Implement enterprise browser policy (Google Admin Console or Microsoft Intune) to restrict extension installation to an approved allowlist, preventing unapproved acquisitions or updates from reaching managed endpoints.
  5. Monitor endpoint telemetry for persistent WebSocket connections originating from browser extension processes, anomalous declarativeNetRequest rule changes, and outbound traffic to Cloudflare Workers subdomains not associated with legitimate business services.
  6. Rotate credentials and revoke active sessions for any cryptocurrency exchange accounts, MetaMask wallets, Facebook business pages, and LinkedIn accounts accessed on devices where these extensions were installed.

Uncertainties and evidence gaps

  • Total user count across all 19 extensions has not been published; the 80,000 figure covers only the single largest extension.
  • Threat actor identity and geographic origin remain unattributed; Socket's 'Superior' label derives from module naming conventions, not confirmed actor intelligence.
  • The volume and value of cryptocurrency actually drained has not been disclosed.
  • It is unconfirmed whether the Microsoft Edge Add-ons store has since removed the remaining listed extensions following Socket's disclosure.
  • The connection between the Superior campaign and the February 2024 DomainTools-documented activity is based on TTP overlap and infrastructure patterns, not confirmed shared code or operator identity.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUser must voluntarily install one of the 19 identified extensions from the Chrome Web Store or Edge Add-ons store, or have a previously clean extension silently updated to the malicious version via browser auto-update.
ComponentBrowser extension runtime — specifically the content script injection layer, declarativeNetRequest API, and chrome.scripting.executeScript API.
MechanismExtensions abuse broad host permissions (access to all sites) combined with declarativeNetRequest to remove CSP headers, then use chrome.scripting.executeScript to inject dynamic JavaScript modules — received from a WebSocket C2 — directly into the main world execution context of visited pages.
ImpactFull in-browser session hijacking and credential theft across cryptocurrency exchanges and social platforms; cryptocurrency wallet draining via UI hijacking; hardware-wallet seed-phrase exfiltration via phishing overlays; complete browser history exfiltration.
DetectionPersistent WebSocket connections from browser extension processes to the identified C2 domains; declarativeNetRequest rules observed stripping Content-Security-Policy response headers across all sites; outbound HTTPS to saghirmohamed19[.]workers[.]dev or cookie-whitelist[.]top; presence of extension IDs listed in Socket's advisory.
MitigationRemove identified extensions using the full extension ID list in Socket's advisory; apply enterprise browser policy to blocklist or restrict extension installation; rotate credentials and sessions for any accounts accessed during the period of installation.
Exploitation status

No CVE-tracked vulnerability exploited; the Superior malware framework was actively delivered to approximately 80,000 Chrome and Edge users via malicious extensions live on official browser add-on stores from at least early 2024 until Google removed the Chrome versions in August 2026, with the Edge variant remaining available at time of disclosure.

Research process

Investigation began with the BleepingComputer article as the sole source material, establishing that Socket had discovered 19 malicious Chrome and Edge extensions in a modular malware campaign. Socket's primary technical blog post was located and verified, providing the campaign name (Superior), full infrastructure details, module capabilities, and the extension acquisition tactic. The Hacker News provided independent corroboration and confirmed the 80,000-user impact figure. A historical thread was traced to DomainTools research from 2024–2025 documenting the same unknown actor's earlier infrastructure, supporting the two-year campaign timeline. No CVEs, CISA advisories, or named threat actor attribution were found across any verified source.

  1. What does the primary news source report about this campaign?
    Fetched BleepingComputer article
    bleepingcomputer.com ↗

    19 malicious modules across Chrome and Edge extensions; five acquired from original developers; campaign potentially active since early 2024; Google removed Chrome listings; Edge version still live; no CVEs cited.

    why Establishes the basic factual frame and confirms Socket as the originating researcher, directing subsequent investigation to Socket's primary report.

  2. What does Socket's own technical report reveal about the campaign's architecture and scope?
    Fetched Socket's primary disclosure blog post
    socket.dev ↗

    Campaign named 'Superior'; 18 Chrome + 1 Edge extension; 5 acquired, 14 actor-created; AES-GCM encrypted WebSocket C2 with per-victim key; 19 JavaScript modules; CSP stripping via declarativeNetRequest; 20+ C2 domains identified; Cloudflare Workers used for exfiltration; no CVEs; no specific threat actor attribution.

    why This is the authoritative technical source. It resolves mechanism, infrastructure, module capabilities, and extension identity — the core of the technical assessment.

  3. Is there independent corroboration from a second source, and is there any additional context on attribution or user impact?
    Searched for Superior campaign coverage and fetched The Hacker News article
    thehackernews.com ↗

    Confirms 80,000 combined installs; references DomainTools Investigations as having documented related activity in May 2025; QuickLens extension previously flagged by Annex Security and monxresearch-sec earlier in 2026.

    why Provides the second independent verified source required for medium/high confidence and adds prior-detection context indicating the campaign was observable before Socket's disclosure.

  4. What does the DomainTools prior research establish about the threat actor's historical activity and infrastructure?
    Fetched DomainTools Investigations article on dual-function Chrome extension malware
    dti.domaintools.com ↗

    DomainTools documented an unknown actor deploying 100+ fake websites and malicious Chrome extensions with WebSocket C2 and arbitrary code execution since approximately February 2024, using NameSilo/Cloudflare infrastructure with HMAC-SHA256-signed API calls.

    why Supports the two-year campaign timeline and confirms the TTP pattern (WebSocket C2, broad host permissions, fake utility extensions) predates the Superior disclosure, though no direct code-level link to Superior is confirmed.

  5. Does the broader May 2025 reporting on 100+ fake Chrome extensions further corroborate the actor pattern?
    Fetched The Hacker News May 2025 article on 100+ fake Chrome extensions
    thehackernews.com ↗

    Confirms the same actor pattern — fake utility sites driving Chrome Web Store installs, WebSocket C2, credential/cookie theft — across 40+ extensions in three phishing campaigns, with DeepSeek, Manus, and FortiVPN used as lures.

    why Corroborates that the threat actor's modus operandi is a sustained, evolving programme rather than a one-off campaign, raising the evidentiary basis for the two-year timeline claim.

  6. Has Google or any government authority issued a formal advisory or are there CISA KEV listings related to this campaign?
    Searched for Google Chrome Web Store advisory and government response

    No formal Google Security Advisory or CISA Known Exploited Vulnerabilities entry found for this campaign. Google's action is confirmed as removal of extensions from the Chrome Web Store, reported across multiple sources but not documented in a dedicated advisory page.

    why Absence of a formal advisory is a material fact for defenders who might expect official guidance; it means the Socket blog remains the definitive reference for extension IDs and indicators of compromise.

Named in this story
ActorsUnknown (Socket campaign designation: Superior)
MalwareSuperior framework (modular WebSocket C2 + 19 JavaScript payloads)
TargetsCryptocurrency wallet users (EVM, Solana, Tron)Ledger and Trezor hardware wallet usersCoinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, MetaMask account holdersFacebook and LinkedIn usersGeneral browser users (credential and history theft)

Research coverage

All 73 registered source leaves were evaluated for this run: 65 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 64 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 73 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok3 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
CERT-EU Threat Intelligencenews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1685 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5333 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok688 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1013 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok8074 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok14 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1591 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
SentinelLabsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos X-Opsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The DFIR Reportnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit 42news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
WeLiveSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Additional verified pages 4 opened outside the registered collection
References & evidence
Vendor & gov advisories1
19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads | Socket socket.dev ↗

Primary disclosure and technical advisory from Socket, including full extension ID list, C2 domains, and module-level capability breakdown.

Analysis & research4
Chrome Web Store extensions caught stealing crypto, browser data | BleepingComputer bleepingcomputer.com ↗

Independent write-up confirming scope, acquisition method, Google removal status, and Edge availability at publication.

19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code | The Hacker News thehackernews.com ↗

Second independent corroboration; adds DomainTools prior-research context and 80,000 combined install figure.

Hidden Threats of Dual-Function Malware Found in Chrome Extensions | DomainTools Investigations dti.domaintools.com ↗

Earlier research documenting the same unknown actor's infrastructure and TTP pattern from February 2024 onward, corroborating the campaign timeline.

100+ Fake Chrome Extensions Found Hijacking Sessions, Stealing Credentials, Injecting Ads | The Hacker News thehackernews.com ↗

May 2025 reporting on the broader actor pattern — over 100 fake sites and extensions using WebSocket C2 and DOM manipulation — supporting a sustained multi-year campaign.