A sophisticated malware campaign has been uncovered in the Google Chrome Web Store and Microsoft Edge add-ons marketplace, where malicious extensions have been stealing cryptocurrency, sensitive browser data, and even injecting fake browser updates. The operation, which may have started as early as 2024, involved at least 16 extensions that provided distinct functionalities, including draining digital wallets, phishing users for their seed phrases, and exfiltrating browser history.
The investigation was conducted by application security company Socket, who found that five of the malicious extensions were initially acquired from their original creators before being injected with malware through automatic updates. One of these extensions, “Enable Right Click & Copy — Smart Unlock + OCR,” had a user base of over 70,000 on Chrome and 10,000 on Edge at the time it turned malicious. Google was quick to respond by removing the extension from its marketplace, but unfortunately, the Edge version remained available until Socket published its report.
Once installed, the malware establishes an encrypted connection with command-and-control (C2) servers, downloads JavaScript modules, removes website security policies, and injects malicious scripts into websites through hidden HTML elements. The malware’s capabilities are alarming, including draining digital wallets, phishing users for their seed phrases, stealing sessions and tokens from popular cryptocurrency exchanges, recording credentials and form entries across websites, and even exfiltrating browser history.
The operation is particularly concerning due to its ability to adapt and evolve over time, with new payloads expected to be deployed as the malware framework continues to change. Users who had any of the malicious extensions installed should assume that their credentials have been compromised and take immediate action by changing their login passwords. Cryptocurrency holders potentially impacted by this campaign are recommended to move their assets to a newly created wallet as soon as possible.
The incident highlights the ongoing threat posed by malware campaigns in popular add-ons marketplaces, emphasizing the need for users to exercise caution when installing extensions from unknown developers. It also underscores the importance of monitoring one’s digital footprint and taking proactive measures to protect sensitive data. As security experts continue to warn, prevention scores can hide what happens after initial access – once attackers have valid credentials, only 37% of their actions are blocked.
In light of this incident, it is essential for users to remain vigilant and take the following precautions: regularly review installed extensions, check for updates, and be cautious when installing new ones; use strong, unique passwords for all accounts; monitor browser history and login activity; and consider using a reputable password manager. By staying informed and taking proactive measures, we can mitigate the risks posed by these types of malware campaigns and protect our digital assets from malicious actors.
Source: Bleeping Computer — 2026-08-30