Back Feeds.4Sysops

19 Chrome and Edge extensions turn into modular crypto stealers

Feeds.4Sysops •IT News • August 28, 2026

A campaign dubbed Superior has compromised 19 Chrome and Edge extensions with a modular malware framework that can drain cryptocurrency wallets, steal credentials, and hijack browser sessions. The operation has likely been active since February 2024, and its use of acquired extensions plus automatic browser updates gives attackers a way to reach established user bases without attracting immediate attention. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Chrome and Edge Extensions Target Crypto Users A coordinated malware campaign has compromised 19 browser extensions—18 for Chrome and 1 for Edge—designed to steal cryptocurrency wallet secrets and login credentials. The campaign, named 'Superior,' has been active since February 2024 and uses a strategy where legitimate extensions are acquired and later weaponized. The most impactful extension, 'Enable Right Click & Copy — Smart Unlock + OCR,' had around 80,000 users before malicious code was introduced. Attackers utilize techniques such as establishing persistent WebSocket connections and injecting hidden scripts to exfiltrate sensitive data. While the Chrome version of the extension has been removed, the Edge version remains active. The malicious extensions have been linked to a broader campaign that has evolved over time, indicating a sustained effort to exploit users. Researchers are tracking the operation closely due to its potential widespread impact on users' security. 10 sources 69

Extracted Entities

19 Chrome and Edge extensions turn into modular crypto stealers

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Platforms (1)

Tools (1)