18 Chrome extensions and one for Edge stole crypto wallet keys

Researchers at Socket have uncovered a cluster of 18 Google Chrome extensions and one for Microsoft Edge that, over the past six months, gained functionality for stealing crypto wallet secrets and draining cryptocurrency accounts. According to Socket expert Carlo Zanki, they are all similar in code and technique, and the campaign itself — dubbed Superior — appears to have been active since February 2024.

How the scheme works

The playbook is simple, and that is exactly what makes it dangerous. The attacker either buys a legitimate, fully working extension from its previous owners or publishes a “clean” version with no malicious code themselves. Once the product builds up an audience, an update rolls out — this time with a malicious payload baked in. Of the extensions identified, 14 were created by the attackers themselves, while another five were bought from their previous authors.

The one with the widest reach is “Enable Right Click & Copy — Smart Unlock + OCR,” with a combined base of 80,000 installs across Chrome and Edge. Among the others are tools for checking SEO and traffic, crypto news readers, exchange-rate converters and wallet trackers.

What the malware can do

Each extension opens a persistent WebSocket connection to a command-and-control server (C2). Zanki notes that the loader can change the C2 address on command, distributing victims across different groups and dedicated infrastructure — which lowers the risk of detection. The exfiltration endpoint is also assigned dynamically, so a separate leak channel is set up for each victim.

Once it lands on a page, the code strips out Content Security Policy headers and injects JavaScript modules through content scripts. In all, the researchers counted 16 modules: multi-network wallet drainers, collectors of seed phrases from hardware wallets, exchange credential interceptors, universal form grabbers, Facebook and LinkedIn account thieves, browser history stealers, and a ClickFix-style lure. The last of these displays a fake browser update window and, adapting to the operating system, coaxes the user into copying and pasting a malicious command.

Who is behind it

Isolated traces of the campaign had been spotted before: the “QuickLens” extension was flagged earlier this year by Annex Security and monxresearch-sec, and DomainTools described part of the activity back in May 2025 — at the time, the attackers were creating fake sites posing as productivity, VPN and banking services.

Exactly who is behind Superior remains unknown, but two years of successful operation point to a “highly capable” adversary. The main threat, Zanki stresses, lies in the scheme itself: hijacking a legitimate extension, combined with Chrome's default settings that install updates automatically, gives attackers a powerful vector for instantly reaching a product's entire audience.

Source: The Hacker News