Researchers identified 18 malicious Google Chrome extensions and one Microsoft Edge extension that share similar code, infrastructure, and operational techniques.
Socket is tracking the activity as the Superior campaign, which appears connected to malware activity first reported by DomainTools in February 2024 and later analyzed by Secure Annex.
The campaign abuses trust in legitimate-looking browser tools. The affected extensions advertised features such as SEO statistics, crypto-price monitoring, screen-search tools, ad spying, and copy-unlocking utilities.
Their first published versions were clean and performed their claimed functions. After building a user base, attackers released updates that silently added malicious code.
Socket said 14 extensions were created by the threat actors, while five were reportedly acquired from legitimate developers.
Rogue Extensions Steal Wallets
The extension with the largest potential impact was “Enable Right Click & Copy Smart Unlock + OCR.” It was originally developed by PreppHint before being acquired by the attackers.
When malicious behavior was introduced, the Chrome extension had roughly 70,000 users. Its Edge counterpart had about 10,000 users, creating a possible exposure surface of 80,000 installations.
This does not mean every user received the malicious version, but browser extensions normally update automatically, allowing attackers to rapidly distribute harmful updates.
Google removed the malicious Chrome version from the Chrome Web Store. However, Socket said the Edge version remained available and continued serving malware at the time of reporting.
After the Chrome listing was removed, the attackers reportedly updated the Edge extension with a new command-and-control, or C2, domain on August 14, 2026.
The malware uses a background service worker to create a persistent WebSocket connection with its C2 server. It generates a unique victim identifier, stores data in chrome.storage, and receives encrypted JavaScript modules from attackers.
The framework can also rotate C2 endpoints and use separate exfiltration servers for each victim, making disruption and detection more difficult.
A key technique involves stripping Content Security Policy headers from websites visited by victims. CSP is a browser security control that restricts which scripts and resources can run on a page.
Removing it allows the malicious extension to inject attacker-controlled JavaScript into targeted sites. The injected payloads can detect Ethereum-compatible, Solana, and Tron wallets.
They can hijack legitimate “Connect Wallet” or “Swap” buttons, replace their event handlers, and trick victims into approving malicious transactions.
Other modules impersonate Ledger and Trezor recovery or update pages, prompting victims to enter 12-, 18-, or 24-word seed phrases. Attackers can use a stolen seed phrase to fully control a crypto wallet, Socket said.
The campaign also targets logged-in users of Coinbase, Binance, Kraken, OKX, KuCoin, Bybit, MEXC, MetaMask, and other services. It steals session cookies, authorization tokens, balances, and account information.
A universal form-grabbing module records text, email, and password inputs across websites, while separate modules target Facebook tokens, LinkedIn sessions, and browser history.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
