19 Chrome and Edge Extensions Deliver Wallet Drainers and Credential-Stealing Malware

Aug 27, 2026 · Original article ↗

Summary

Socket analyzed 19 malicious Chrome and Edge extensions linked to the Superior campaign. Their C2-controlled malware can steal wallet secrets, credentials, session data and browsing history; one Edge extension was still active when reported.

Key points

Socket identified 18 malicious Chrome extensions and one Edge extension, linking their techniques to a campaign tracked as Superior that dates back to February 2024.
The extensions establish WebSocket connections to C2 servers, download modular JavaScript payloads and can rotate C2 and exfiltration endpoints.
They strip Content Security Policy protections and inject downloaded code into visited websites, enabling payload execution in the page context.
Observed modules target cryptocurrency wallets and exchange accounts, steal recovery phrases, credentials and session data, harvest social-media information, and exfiltrate browsing history.
The operators publish clean versions before adding malware and have also acquired legitimate extensions; one acquired extension had about 70,000 Chrome users and 10,000 Edge users.
At the time of Socket’s report, the malicious Chrome extension had been removed from the Chrome Web Store, while its Edge counterpart remained active and had been reported to the Edge extension store.

Article Details

Attack Vectors: The threat actor published initially clean extensions and later introduced malicious functionality through updates. Five extensions had been acquired from legitimate authors; 14 were threat actor-created.
Malicious extension service workers contact C2 servers, receive JavaScript modules, and store them in extension local storage. Observed versions use persistent WebSocket connections, and the framework supports C2 endpoint rotation.
The extensions remove Content Security Policy headers from visited pages and trigger downloaded JavaScript through event handlers on temporary hidden DOM elements.
Observed modules hijack wallet connection and swap buttons, present fake hardware-wallet restoration flows to capture recovery phrases, collect authenticated session material, and capture form inputs.
A fake browser-update lure instructs users to paste and run an attacker-supplied command.
Defensive Notes: Review installed browser extensions regularly and remove unnecessary or suspicious ones.
Exercise caution before installing extensions and continue monitoring trusted extensions, because ownership and behavior can change through updates.
Socket reported that the malicious Chrome version of Enable Right Click & Copy — Smart Unlock + OCR had been removed from the Chrome Web Store, while its Edge version was still serving malware at the time of writing. Socket reported the Edge finding to its extension store.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`active-enable-right-click[.]top`	Listed primary C2 domain.
DOMAIN	`api[.]active-enable-right-click[.]top`	C2 endpoint domain shown in the extension's default configuration code.
DOMAIN	`api[.]codefilearc[.]net`	Listed primary C2 domain.
DOMAIN	`api[.]creativelibrary[.]top`	Listed primary C2 domain.
DOMAIN	`api[.]enable-right-click[.]click`	Listed primary C2 domain.
DOMAIN	`api[.]extensionanalyticspro[.]top`	Listed primary C2 domain.
DOMAIN	`blockfolioaddressmonitor[.]pro`	Listed primary C2 domain.
DOMAIN	`content[.]resonanceweb[.]top`	Listed primary C2 domain.
DOMAIN	`cookie-whitelist[.]com`	Wallet-drainer script server identified in the related DomainTools research dataset.
DOMAIN	`cookie-whitelist[.]top`	Domain identified as hosting wallet-drainer scripts.
DOMAIN	`cryptopricebadgequickglance[.]pro`	Listed primary C2 domain.
DOMAIN	`cryptoratesfiatconverter[.]pro`	Listed primary C2 domain.
DOMAIN	`defipulsetracker[.]pro`	Listed primary C2 domain.
DOMAIN	`enable-right-click[.]click`	Listed primary C2 domain.
DOMAIN	`extension[.]io-safe[.]icu`	Listed primary C2 domain.
DOMAIN	`feedback[.]feedx-ray[.]top`	Listed primary C2 domain.
DOMAIN	`ggle-analytics[.]com`	Domain identified as serving fake wallet-restoration and browser-update content.
DOMAIN	`lucky-random[.]sbs`	Listed secondary C2 domain.
DOMAIN	`password-protect-pdf[.]com`	Listed primary C2 domain.
DOMAIN	`payload[.]siteinsight[.]bond`	Listed primary C2 domain.
DOMAIN	`pricealarmsvolatilitywarnings[.]pro`	Listed primary C2 domain.
DOMAIN	`privatecryptonewsreader[.]pro`	Listed primary C2 domain.
DOMAIN	`relay[.]seopulsepro[.]sbs`	Listed primary C2 domain.
DOMAIN	`whale-alert[.]art`	Domain identified as hosting wallet-drainer scripts.
DOMAIN	`whale-alert[.]life`	Wallet-drainer script server identified in the related DomainTools research dataset.
DOMAIN	`ws[.]seopulsepro[.]sbs`	Listed primary C2 domain.
DOMAIN	`ws[.]site-signal[.]top`	Listed primary C2 domain.
HOSTNAME	`mimi[.]saghirmohamed19[.]workers[.]dev`	Cloudflare Worker identified as a data-exfiltration sink.
HOSTNAME	`pipi[.]saghirmohamed19[.]workers[.]dev`	Cloudflare Worker identified as a data-exfiltration sink.