19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code
A coordinated threat campaign dubbed "Superior" has been identified, involving 18 Chrome and 1 Microsoft Edge extensions containing wallet-stealing and cryptocurrency-draining malware, active since February 2024. The threat actor employs a two-stage publish strategy: releasing clean, functional versions to build user trust and install base, then pushing malicious updates that connect to command-and-control (C2) servers. The most impactful extension, "Enable Right Click & Copy — Smart Unlock + OC
Analysis
TL;DR
- A coordinated threat campaign dubbed "Superior" has been identified, involving 18 Chrome and 1 Microsoft Edge extensions containing wallet-stealing and cryptocurrency-draining malware, active since February 2024.
- The threat actor employs a two-stage publish strategy: releasing clean, functional versions to build user trust and install base, then pushing malicious updates that connect to command-and-control (C2) servers.
- The most impactful extension, "Enable Right Click & Copy — Smart Unlock + OCR," has an install base of approximately 80,000 users across Chrome and Edge browsers.
- The malware framework strips Content Security Policy (CSP) headers and injects 16 distinct malicious modules, including multi-chain wallet drainers, seed-phrase harvesters, credential grabbers, and ClickFix-style social engineering lures.
- A key operational technique involves C2 endpoint rotation and dynamically assigned per-victim exfiltration channels, making detection and takedown significantly more difficult.
Why It Matters
This campaign highlights a sophisticated supply-chain-style attack vector targeting the browser extension ecosystem, demonstrating how threat actors can exploit auto-update mechanisms to silently compromise tens of thousands of users. For AI and security practitioners, it underscores the critical importance of monitoring extension behavior, validating code integrity, and understanding how malicious actors leverage legitimate platforms for large-scale credential and cryptocurrency theft.
Technical Details
- Campaign Structure: The "Superior" campaign consists of 19 extensions (18 Chrome, 1 Edge), with 14 created from scratch by the threat actor and 5 acquired from previous legitimate owners. The attack has been ongoing since at least February 2024.
- C2 Communication: Each extension establishes a persistent WebSocket connection to a command-and-control server. The framework supports dynamic rotation of C2 endpoints and per-victim exfiltration channels, both dynamically assigned via C2 instructions.
- Malicious Modules (16 identified): Multi-chain wallet drainer, hardware-wallet seed-phrase harvester, cryptocurrency exchange and wallet account harvester, universal credential/form grabber, Facebook and LinkedIn account stealers, browser history stealer, and ClickFix-style lure.
- CSP Bypass & Code Injection: The malware strips Content Security Policy headers from every page and injects JavaScript code modules on targeted websites using content scripts, enabling arbitrary code execution.
- ClickFix Social Engineering: One module injects a fake web browser update notification and provides OS-specific instructions to trick users into copying and pasting malicious commands into their terminal.
- Fake Website Infrastructure: The threat actor created deceptive websites masquerading as legitimate services, productivity tools, VPNs, and cryptocurrency utilities to drive users toward malicious Chrome Web Store listings.
Industry Insight
- Browser extension marketplaces require enhanced code-signing verification and anomaly detection on updates, particularly when a previously clean extension suddenly changes behavior or communication patterns.
- Security teams and individual users should audit installed extensions regularly, revoke access for any that request excessive permissions, and consider disabling auto-update for non-critical extensions to prevent silent malicious payload delivery.
- The two-year operational longevity of this campaign indicates a well-resourced and technically capable threat actor; this should prompt the security community to treat browser extension supply-chain attacks as a persistent and evolving threat category requiring proactive monitoring and threat intelligence sharing.
Disclaimer: The above content is generated by AI and is for reference only.