19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads

The threat involves 19 malicious browser extensions targeting Chrome and Edge browsers, identified over the last six months. These extensions form an extendable malware framework that establishes WebSocket communication with C2 servers, strips Content Security Policy headers to bypass browser security, and uses XSS injection to execute malicious payloads. The main objective is cryptocurrency wallet secret theft and crypto draining, alongside credential harvesting. The adversary employs two methods: developing malicious extensions from scratch and weaponizing legitimate extensions with established user bases. The campaign, tracked as 'Superior,' has been active since February 2024 and demonstrates persistent evolution and operational sophistication. The most notable compromised extension is 'Enable Right Click & Copy,' which had approximately 70,000 Chrome users and 10,000 Edge users at the time of compromise. The campaign targets multiple cryptocurrency platforms and exchanges.

The campaign enables attackers to steal cryptocurrency wallet secrets and drain crypto assets from victims, as well as harvest user credentials. The use of WebSocket C2 communication and CSP stripping allows the malware to bypass browser security controls, increasing the risk of successful exploitation. The compromise of legitimate extensions with large user bases significantly increases the potential victim pool. This poses a medium risk to users of affected browser extensions, particularly those involved in cryptocurrency transactions.

No official patch or vendor advisory is provided for these malicious extensions. Users should immediately uninstall any suspicious or untrusted browser extensions, especially those identified as malicious or compromised. Review and revoke permissions for extensions that request excessive access. Monitor official browser extension stores for updates or removals of these extensions. Employ browser security features and consider using security tools that detect malicious extensions. Since this is a supply chain compromise, organizations should enforce policies restricting extension installation and educate users about the risks. Patch status is not yet confirmed — check browser vendor advisories and security community updates for current remediation guidance.