Malicious Chrome and Edge Extensions Steal Crypto, Credentials, and Browser Data
Summary
Socket found 16 malicious modules delivered through Chrome and Edge extensions, some after legitimate add-ons were acquired and updated. They stole crypto and account data, exfiltrated browser history, and injected ClickFix lures; one Edge listing remained available at報
Key points
- Socket uncovered 16 malicious modules with distinct functions and said the campaign may have been active since early 2024.
- Researchers say five extensions were acquired from their original creators and infected through automatic updates after initially offering legitimate features.
- The malware uses an encrypted WebSocket connection to download JavaScript modules, remove CSP headers, and inject scripts into visited websites.
- Modules could drain cryptocurrency wallets, steal wallet seed phrases and account credentials, harvest Facebook and LinkedIn data, exfiltrate browser history, and display ClickFix lures.
- One extension had at least 70,000 Chrome users and 10,000 Edge installs; Google removed it from the Chrome Web Store, but its Edge version remained available when Socket published its report.
- Socket advises affected users to change passwords; cryptocurrency holders should move assets to a newly created wallet.
Article Details
- Event Type
- Malicious browser-extension campaign
- Impact
- Extensions for Google Chrome and Microsoft Edge deployed a malware framework with 16 reported modules. The modules could steal cryptocurrency, credentials, session and account data, and browser history, and inject ClickFix lures or seed-phrase phishing pages. One extension had at least 70,000 Chrome users and 10,000 Edge installs when it turned malicious; the article does not report confirmed victim or financial-loss totals.
Vendors
GoogleMultiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, and to inject ClickFix lures.MicrosoftMultiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, and to inject ClickFix lures.
Products
Google ChromeMultiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, and to inject ClickFix lures.Microsoft EdgeMultiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, and to inject ClickFix lures.