Multiple extensions for Google Chrome and Microsoft Edge have been identified as delivering a sophisticated malware framework designed to steal cryptocurrency, sensitive user data, and browser history. The operation, uncovered by application security company Socket, appears to have been active since early 2024.
The malicious framework, which researchers describe as "highly extensible," utilizes 19 distinct modules to achieve its objectives. Initially, many of the extensions offered their advertised functionality without overt malicious code. However, Socket's investigation indicates that five of the extensions were acquired from their original developers and subsequently updated with the malware.
One notable example is "Enable Right Click & Copy Smart Unlock + OCR," which had an estimated 70,000 Chrome users and 10,000 Edge users when it became malicious. While Google promptly removed this extension from the Chrome Web Store, the Edge version remained available at the time of Socket's report.
Upon installation, the malware establishes an encrypted WebSocket connection with command-and-control (C2) servers. It then downloads JavaScript modules, removes Content Security Policy (CSP) headers from visited websites, and injects malicious scripts through hidden HTML elements.
The observed capabilities of the malware modules include: draining EVM, Solana, and Tron wallets by hijacking legitimate "Connect Wallet" and "Swap" buttons; replacing Ledger and Trezor websites with convincing seed-phrase phishing pages; stealing sessions, tokens, account data, and balances from major cryptocurrency exchanges such as Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, and MetaMask; recording credentials and form entries across various websites; harvesting Facebook and LinkedIn account information; exfiltrating browser history; and displaying "ClickFix"-style fake browser updates that prompt victims to execute attacker-provided commands.
Socket warns that the framework may contain additional modules and is expected to evolve with new payloads over time. As of the report's publication, none of the identified malicious extensions are available in the Chrome Web Store.
The full list of affected extensions includes: "Enable Right Click & Copy Smart Unlock + OCR" (pkoccklolohdacbfooifnpebakpbeipc), "RapidLens - Google Lens for Screen Search & Images" (fegckejpfnlmfgkfjpinlbgmeeijjkel), "QuickLens - Search Screen with Google Lens" (kdenlnncndfnhkognokgfpabgkgehodd), "Password Protect PDF" (jamminefolhgepgihbmcjjhgldbfcikp), "Allow Copy - Select & Enable Right Click" (Edge extension) (inmkjedjdhgpknjogbjomhnbgdccckkg), "PixelCheck" (fcgdejjichpgfaaafflplhfijcnieopb), "Creative Library - Ad Spy Tool" (cfpnjdbpojpcongfaefcamjbaolpelcd), "Website Traffic Checker: MirrorSphere SEO Stats" (aapdalkmclfaahehnmicbglkohkldhne), "Site Signal - Website Traffic & SEO Checker" (dkdadldmiefjldmegbjbnhhfddnkhlhm), "SEO Pulse Pro - Website Traffic & SEO Analyzer" (fjmlhlkccegopebcllcmafahkmeejpph), "Private Crypto News Reader" (iekoapohahgmogbagegmcgplbkikcgke), "Blockfolio: Address Monitor" (ahpnnnjbnfbhoikhohglpohnoocjcoco), "Crypto Rates & Fiat Converter" (oeacadlaclegkkkdehjmiifnjhcekclj), "Crypto Alerter: Price Alarms & Volatility Warnings" (jmlgannjlbliikgcaieomgmcnfplglea), "DeFi Pulse Tracker" (lhmcajhgadanidbopgaoobjlldegjmke), "Crypto Price Badge: Quick Glance" (gfackggoapepdmnjnfblogdcjpgcjiak), "Multi-Chain Explorer" (hfijkbdkpidafdbeebnnkhfccildbcle), "LedgerLook: Wallet Checker" (pcngchfbfgejllcbhmeadjhiebebiome), and "Meta & Facebook Ad Library Spy Save Ads, Finder, Downloader | FeedX-Ray" (aodkjdeghbjiaienipfjkbpcikkacbcp). Socket's report also provides the domains used for C2 communication.
Users who have installed any of these extensions should consider their credentials compromised and are advised to change their login passwords immediately. Cryptocurrency holders potentially affected by this campaign should transfer their assets to a newly created wallet as soon as possible.
