Investigation Uncovers Malicious Browser Extensions Targeting Google Chrome and Microsoft Edge Users
A recent investigation has raised alarming concerns regarding malicious browser extensions affecting users of major web browsers, specifically Google Chrome and Microsoft Edge. Researchers identified a total of 19 harmful extensions—18 developed for Chrome and one specifically for Microsoft’s Edge—that employ a modular malware framework designed to compromise website security protocols.
According to the findings from cybersecurity firm Socket, 14 of these identified extensions were created by a single threat actor, who had acquired five additional extensions from legitimate developers before weaponizing them. One particularly noteworthy extension, named “Enable Right Click & Copy Smart Unlock + OCR,” initially developed by PreppHint, was among the malicious tools injected into users’ browsers. This extension was significant not only due to its widespread use but also because of its capability to bypass security measures.
The investigation highlighted a set of identified extensions that included a variety of seemingly legitimate tools, such as SEO utility extensions, cryptocurrency price trackers, screen-search utilities, ad-spying tools, and utilities designed to enable right-click functionality. The threatening updates to these extensions were introduced while the “Enable Right Click & Copy Smart Unlock + OCR” alone boasted around 70,000 users, leading to the unfortunate conclusion that approximately 80,000 user installations across both platforms were exposed to these malicious activities.
While Chrome was quick to remove the malicious listing from its platform, the Edge version remained active at the time of publication. This Edge extension had undergone a significant upgrade that introduced a new command-and-control (C2) domain, indicating ongoing malicious activity and the potential for continued exploitation.
The malicious browser extensions utilize background service workers to establish encrypted WebSocket channels with the threat actor’s command-and-control infrastructure. Each installation of these extensions is assigned a unique user identifier (UUID), while the downloaded JavaScript modules are encrypted using AES-GCM encryption, employing a key derived from both the extension ID and the installation UUID.
These malicious frameworks maintain a consistent heartbeat connection—typically every five minutes—allowing the operators to issue commands that can rotate the command-and-control infrastructure. This operational model provides the flexibility to shift victims between backend servers, optimize their network infrastructure, and designate unique data-exfiltration endpoints for each victim. This adaptive approach raises serious concerns as it enables the threat actor to modify their objectives without necessitating a conspicuous static update to the extension.
The implications of these findings echo prior research by DomainTools, which documented similar malicious Chrome extensions as early as February 2024. Such extensions often combine legitimate functionalities with remote code retrieval capabilities, arbitrary script execution, broad browser permissions, and continuous backend communications. DomainTools also noted that some employed Document Object Model (DOM) event-handler techniques designed to circumvent or weaken Content Security Policy (CSP) controls.
Socket has identified this particular campaign under the label “Superior,” highlighting how these seemingly legitimate extensions lure users in with their advertised functionality—only to later introduce malicious code during updates. Upon startup, the malicious service worker actively creates dynamic declarative NetRequest rules, which strip away key security protocols such as Content-Security-Policy, Content-Security-Policy-Report-Only, X-WebKit-CSP, and X-Content-Security-Policy response headers, from both main frames and subframes.
The removal of these protective measures opens a direct pathway for attacker-supplied code to be executed within targeted websites. Leveraging content scripts and Chrome extension APIs, the malware then retrieves encrypted modules from Chrome’s storage. More sophisticated samples are reportedly capable of dynamically injecting scripts via the chrome.scripting.executeScript method, thereby reducing the visibility typically associated with static wildcard content-script declarations.
In an even more alarming tactic, the extensions create hidden DOM elements—such as input fields, images, and forms—and attach malicious event handlers, which they can subsequently trigger programmatically before quickly removing any trace of their activity. This method grants the injected code access to the site’s original JavaScript context, making it highly effective for executing malicious user-defined actions.
Observations by Socket indicated the use of 16 different modules, with a prominent focus on multi-chain wallet drainers that seek out Ethereum Virtual Machine (EVM), Solana, and Tron wallets. The malware retrieves specific second-stage code tailored for various blockchain platforms and hijacks legitimate website controls such as “Connect Wallet” and “Swap.” By duplicating these buttons and redirecting user interactions, operators can lead victims into pathways that permit unauthorized access to their assets.
Other malicious modules replicate legitimate wallet recovery workflows, effectively duping victims into providing sensitive recovery phrases that could lead to complete wallet compromise. The toolkit has also been observed targeting logged-in sessions across major cryptocurrency exchanges including Binance and Coinbase, further illustrating the severe implications of using compromised extensions.
The campaign underscores the importance of vigilance regarding browser extensions, with experts cautioning that trust in these tools should not be permanent. Chrome’s method of checking for extension updates periodically creates a channel through which malicious updates can be swiftly disseminated among users who unknowingly trust the extension’s functionality.
Considering these findings, organizations are urged to take proactive measures—conducting audits of installed extensions, restricting installations to those from approved publishers, monitoring ownership changes, and remaining vigilant against requests for extensive permissions. Users are further advised to uninstall any identified malicious extensions and update their security credentials if they suspect they have entered sensitive information through suspicious browser prompts.
The cybersecurity landscape is continuously evolving, and vigilance is essential to navigate the risks posed by malicious extensions.