19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code
Summary: Socket researcher Karlo Zanki identified 18 Google Chrome and one Microsoft Edge extensions, published over the last six months, that carried wallet secret stealing and cryptocurrency draining code, with evidence the campaign tracked as Superior may have been active since February 2024. Fourteen extensions were created by the threat actor and five were purchased from prior owners, and the extensions connect to command-and-control servers over persistent WebSocket connections that can rotate endpoints and assign per-victim exfiltration channels.
Why it matters: The extension with the most potential impact, "Enable Right Click & Copy — Smart Unlock + OCR," has a collective install base of 80,000 users across Chrome and Edge, and Chrome's default auto-update setting means a clean extension can turn malicious on users without any action from them.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026