As reported by BleepingComputer, a long-running campaign distributing malicious browser extensions through the Chrome Web Store and Edge Add-ons marketplace has been uncovered by Socket researchers. The operation, active since at least early 2024, involved at least 16 extensions — five of which were legitimately developed tools later acquired by threat actors and weaponized through routine update mechanisms.

Threat Alert: The operation, active since at least early 2024, involved at least 16 extensions — five of which were legitimately developed tools later acquired by threat actors and weaponized through routine update mechanisms.

This is not a story about users installing obviously suspicious extensions. The most damaging aspect of this campaign is the acquisition and weaponization of established, trusted extensions. The "Enable Right Click & Copy — Smart Unlock + OCR" extension had a legitimate user base of 70,000+ on Chrome and 10,000 on Edge before it was turned malicious. Users who had already installed the extension received the malware automatically through the standard browser extension update pipeline. There was no new installation decision to make, no permission prompt to evaluate — just a silent update that fundamentally changed what the software did.

Why the Extension Model Is Structurally Vulnerable

Browser extensions operate with a trust model that assumes the publisher at the time of installation remains the publisher throughout the extension's lifecycle. There is no mechanism to alert users when ownership of an extension changes hands. There is no review triggered when a previously benign extension begins requesting new permissions or establishing encrypted WebSocket connections to unfamiliar infrastructure. The Chrome Web Store's automated review process caught some of these extensions, but the Edge version of at least one remained available at the time of Socket's report — highlighting inconsistent enforcement across marketplaces.

The malware's architecture is worth examining for what it tells us about attacker capability and intent:

  • CSP header stripping: Removing Content Security Policy headers from every visited site is a powerful primitive. CSP is a client-side control that prevents injected scripts from executing. Neutralizing it site-wide opens the door to virtually any injection attack on any page the user visits.
  • Modular payload delivery: The encrypted WebSocket C2 channel downloads JavaScript modules on demand. This means the initial extension is a lightweight loader — the full capability set is determined post-installation and can evolve without requiring a new marketplace update.
  • Wallet hijacking via UI manipulation: Rather than phishing for seed phrases alone, the malware hijacks legitimate "Connect Wallet" and "Swap" buttons on decentralized applications. This bypasses the user's instinct to verify URLs because the interaction appears native to the site they intended to visit.
  • Exchange credential harvesting: Targeting Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, and Bybit indicates broad coverage of the centralized exchange ecosystem. Session token theft is particularly dangerous because it can bypass 2FA.

Who Is Most at Risk

Anyone who had any of the identified extensions installed should assume full credential compromise. The threat surface is not limited to crypto users — the malware also harvested Facebook and LinkedIn account data, browser history, and credentials entered into forms across arbitrary websites. Organizations that allow employee-managed browser extensions are exposed to credential theft affecting corporate SaaS sessions, internal portals, and any web-based authentication flow.

Shield53 Recommendations

For Individuals:

  • Audit your installed browser extensions immediately. Remove anything you do not actively use. Check extension IDs against Socket's published list of identified extensions and C2 domains.
  • If any flagged extension was installed, assume credential compromise. Rotate passwords for all sensitive accounts, revoke active sessions on crypto exchanges and wallet connections, and move any hot wallet funds to a new wallet generated on a clean device.
  • Do not reuse seed phrases. If a Ledger or Trezor phishing page was encountered, the seed phrase should be considered compromised and the wallet must be fully replaced.
  • Review browser extension permissions quarterly. An extension that suddenly requests new permissions or broad host access is a red flag.

For Organizations:

  • Implement browser extension allowlisting via enterprise policy (Chrome's ExtensionInstallAllowlist and ExtensionInstallBlocklist, or equivalent Edge policies). Default-deny is the only defensible posture.
  • Deploy browser extension monitoring tools that alert on extensions establishing WebSocket connections to non-corporate infrastructure or modifying CSP headers.
  • Treat session token theft as a credential compromise event. Force re-authentication across SaaS applications for any user who had a flagged extension installed. Do not assume MFA provides protection — session hijacking bypasses it entirely.
  • Include browser extensions in your incident response scope. Many IR playbooks focus on endpoints and network but ignore the browser as an attack surface.

For the Ecosystem: Browser vendors must implement ownership-change notifications and re-review triggers when extensions change developers, request new permissions post-installation, or begin communicating with new infrastructure. The current model places an unreasonable burden on users to detect supply chain compromises they have no visibility into.