19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads
Socket discovers 19 malicious Chrome and Edge extensions delivering wallet drainers and credential-stealing payloads.
Run Google?
Get an email when a reviewed story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Socket researchers identified 19 malicious browser extensions (18 Chrome, 1 Edge) deployed over six months as part of the "Superior" campaign dating back to February 2024. The extensions employ sophisticated techniques including CSP stripping, XSS injection, and WebSocket C2 communication to deliver modular payloads focused on cryptocurrency wallet theft, credential harvesting, and session hijacking. The threat actors acquire legitimate extensions with established user bases—notably "Enable Right Click & Copy" with ~80,000 combined users across Chrome and Edge—then weaponize them with malicious functionality while leveraging browser auto-update mechanisms for maximum impact.
The lesson from this incident
Full lessonThreat actors acquired legitimate, trusted browser extensions with large existing user bases and silently injected malicious code, exploiting browser auto-update mechanisms to push payloads to tens of thousands of unsuspecting users. This is a classic software supply chain attack: users trusted the extension's established reputation, while the browser's own update infrastructure became the delivery vehicle for credential harvesting and cryptocurrency theft. The use of advanced evasion techniques like CSP stripping and WebSocket C2 communication made detection particularly difficult for average users and even many security tools. This incident highlights that third-party software components — including browser extensions — represent a significant and often overlooked supply chain risk.
What helps against this
How we list vendors
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- domain — active-enable-right-click.top
- domain — api.enable-right-click.click
- domain — cookie-whitelist.top
- domain — whale-alert.art
- domain — ggle-analytics.com
- domain — payload.siteinsight.bond
- domain — enable-right-click.click
- domain — password-protect-pdf.com
- domain — privatecryptonewsreader.pro
- domain — defipulsetracker.pro
- domain — blockfolioaddressmonitor.pro
- domain — pipi.saghirmohamed19.workers.dev
- domain — mimi.saghirmohamed19.workers.dev
- malware — Superior