19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

A cluster of 18 Google Chrome and 1 Microsoft Edge extensions, some purchased and others created by the threat actor, have been discovered harboring wallet-stealing and cryptocurrency-draining capabilities. The campaign, dubbed ‘Superior’ by Socket, has been active since February 2024 and involves acquiring legitimate extensions and releasing updated versions with malicious code. The most impactful extension, ‘Enable Right Click & Copy — Smart Unlock + OCR,’ has 80,000 users and utilizes a sophisticated C2 rotation strategy to evade detection. The threat actor employs techniques like stripping CSP headers and injecting JavaScript modules to steal user data and credentials.