Meta News

A campaign involving browser extensions distributed through the Chrome Web Store and Microsoft Edge Add-ons has exposed how legitimate software can quietly become malicious after users have already learned to trust it. Security researchers uncovered a modular malware framework capable of stealing cryptocurrency, hijacking authenticated sessions, collecting credentials and browsing history, and even presenting victims with ClickFix-style social-engineering attacks.

Application security company Socket identified 19 malicious modules associated with the operation, which researchers believe may have been active since early 2024. Particularly concerning is that several of the extensions were not malicious when they first appeared in official browser marketplaces. Instead, attackers appear to have acquired established extensions from their original developers and later introduced malicious code through automatic updates.

According to Socket’s investigation, at least five extensions were purchased or otherwise acquired from their original creators before malicious functionality was added. This approach gives attackers an important advantage: rather than convincing users to install an obviously suspicious new extension, they inherit an existing product with a user base, reviews and an established reputation.

One prominent example was Enable Right Click & Copy — Smart Unlock + OCR, which had at least 70,000 Chrome users when it became malicious, along with roughly 10,000 installations on Edge. Google detected the threat and removed the extension from its marketplace, although Socket reported that its Edge version remained available at the time of the researchers’ publication. By the time BleepingComputer published its report, none of the identified malicious extensions remained available through the Chrome Web Store.

The campaign also included extensions presented as screen-search utilities, PDF tools, SEO analyzers, cryptocurrency trackers and advertising research tools. The variety suggests that the attackers were less interested in targeting one particular type of user than in establishing access to browsers through software that appeared useful.

Once activated, the malicious framework establishes an encrypted WebSocket connection with its command-and-control infrastructure and downloads JavaScript modules dynamically. It can also remove Content Security Policy headers from visited websites and inject attacker-controlled scripts into pages through hidden HTML elements.

This architecture makes the campaign considerably more capable than a conventional credential-stealing extension. Socket describes the framework as highly extensible, with individual modules responsible for different malicious functions. Attackers can therefore change what an infected browser does without necessarily publishing another extension update.

Cryptocurrency theft is one of the most aggressive capabilities. The malware can manipulate legitimate Connect Wallet and Swap buttons to redirect transactions involving EVM-compatible networks, Solana and Tron. It can also replace legitimate Ledger and Trezor pages with convincing phishing interfaces designed to capture cryptocurrency wallet seed phrases.

Other modules target cryptocurrency platforms including Coinbase, Binance, Kraken, OKX, MEXC, KuCoin and Bybit, as well as MetaMask. The malware can collect sessions, authentication tokens, account details and balance information, giving attackers opportunities to bypass some of the protections normally associated with stealing passwords alone.

Crypto users were not the only targets. The framework can record credentials and information entered into web forms, collect Facebook and LinkedIn account data and exfiltrate browser history. Because extensions operate directly inside the browser, they can observe sensitive information at a particularly valuable point in the authentication process.

The malware can also display ClickFix-style fake browser updates. These attacks typically attempt to convince users that they must perform a technical action to resolve a fabricated problem, ultimately leading them to execute commands supplied by the attacker.

This creates a layered intrusion model. The malicious extension is already operating inside the browser, but it can use that position to convince the victim to execute additional malware at the operating-system level. What begins as a compromised browser extension can therefore become an entry point for a much broader system compromise.

The campaign highlights an uncomfortable weakness in browser extension security. Users are generally advised to obtain extensions only from official marketplaces, and that remains safer than downloading unknown packages from arbitrary websites. But marketplace approval cannot completely protect against software that becomes malicious later.

Automatic updates make the problem particularly difficult. They are essential for quickly distributing security fixes, yet the same mechanism allows a compromised or malicious developer account to push new code to thousands of existing installations without asking every user to approve the change.

The extension’s reputation can also become part of the attack. A user may have installed an add-on years earlier, used it without problems and reasonably concluded that it was trustworthy. If ownership later changes, the security assumptions surrounding that extension can change without the user realizing it.

In that sense, the campaign resembles a software supply-chain attack at browser scale: attackers do not necessarily need to convince every victim individually. They compromise the trust relationship between an existing product and its installed user base.

BleepingComputer recommends that anyone who had one of the identified extensions installed should assume their credentials may have been compromised and change their passwords. Cryptocurrency users potentially affected by the campaign face an even more serious recovery process: they are advised to transfer assets to newly created wallets, particularly because exposure of a wallet’s seed phrase cannot be fixed simply by changing a password.

The distinction matters. Removing a malicious extension prevents it from continuing to operate, but it cannot revoke information that attackers have already collected. Stolen passwords, session tokens and cryptocurrency recovery phrases may remain useful after the original malware has disappeared.

Socket also warns that the 19 identified modules may not represent the framework’s complete capabilities. Because the architecture allows additional payloads to be deployed dynamically, attackers could expand the campaign with new functionality over time.

Modern browsers contain an extraordinary concentration of sensitive information. They maintain authenticated sessions for corporate applications, email, social networks, cloud services and financial platforms. They also increasingly host cryptocurrency wallets and password managers.

An extension with broad permissions can sit directly inside that environment.

That makes extension compromise particularly attractive because attackers may no longer need to steal a password and reproduce a login from another machine. Instead, they can potentially manipulate the already-authenticated environment in which the victim is operating.

The campaign uncovered by Socket demonstrates why extension security should increasingly be treated as part of software supply-chain security. Installing an extension from an official marketplace is only the beginning of the trust relationship.Ownership changes, automatic updates and remotely loaded functionality can transform software that was safe yesterday into a highly privileged attack platform tomorrow.

⁠Original report at BleepingComputer