A massive malware campaign has been uncovered in Google’s Chrome Web Store, with multiple extensions stealing cryptocurrency, browser data, and sensitive information from unsuspecting users. The malicious software, which was delivered via automatic updates to five of the affected extensions, establishes an encrypted connection with command-and-control servers and injects malicious scripts into websites visited by the user.
The campaign, which may have been active since early 2024, involves 16 distinct modules designed to serve various purposes. These include draining cryptocurrency wallets, stealing sessions and tokens from popular exchanges, recording credentials and form entries, and even harvesting Facebook and LinkedIn account information. The malware also displays fake browser updates that instruct victims to execute attacker-provided commands.
Researchers at application security company Socket discovered the campaign after analyzing extensions that were initially available on the Chrome Web Store without any malware. However, when the researchers acquired these extensions from their original creators, they found that they had been injected with malicious code via automatic updates. One of the affected extensions, “Enable Right Click & Copy — Smart Unlock + OCR,” had a user base of at least 70,000 on Chrome and 10,000 on Microsoft Edge.
The malware operates by establishing an encrypted WebSocket connection with command-and-control servers, which then download JavaScript modules that can perform various malicious actions. These include draining cryptocurrency wallets, stealing sensitive information from exchanges, and even hijacking legitimate buttons to steal user funds. The malware also removes Content Security Policy headers from websites visited, making it difficult for users to detect the presence of malicious scripts.
Google was alerted to the threat early on and removed the affected extensions from its add-ons marketplace. However, at the time of publication, the Edge versions of these extensions were still available. Users who had any of the affected extensions installed should assume that their credentials have been compromised and take immediate action to change their login passwords. Cryptocurrency holders are advised to move their assets to a newly created wallet as soon as possible.
This campaign highlights the importance of staying vigilant when installing browser extensions, even from reputable sources like the Chrome Web Store. Users should always be cautious of extensions that promise exaggerated benefits or offer suspicious functionality. By being aware of these risks and taking necessary precautions, users can protect themselves from falling victim to such malware campaigns in the future.
It’s also worth noting that this campaign demonstrates how attackers can use seemingly legitimate software to gain access to sensitive information. Once attackers have valid credentials, they can bypass many security measures, including firewalls and antivirus software. This is why it’s essential for users to stay informed about the latest threats and take proactive steps to protect themselves online.
In conclusion, this malware campaign serves as a stark reminder of the importance of cybersecurity best practices in today’s digital landscape. By being aware of these risks and taking necessary precautions, users can protect themselves from falling victim to such campaigns in the future.
Source: Bleeping Computer — 2026-08-30