Socket Threat Research

Socket researchers found 18 Chrome extensions and one Edge extension delivering a wallet drainer, credential theft, and other malicious payloads.

The Socket Threat Research team identified 18 Chrome extensions and 1 Edge extension sharing similarities in malicious code and malware operation techniques. The malicious versions of identified extensions were published in the last six months, but code and technique similarities reveal a connection to a campaign initially reported by DomainTools, dating back to February 2024. Malware from this campaign has previously also been described in a research investigation conducted by Secure Annex.

All of identified extensions implement the same publishing approach. The first version implements the advertised functionality and is clean of malware. Later, when a base trust is established, a new version is published, introducing the malicious behavior. Identified extensions can be separated into 14 threat actor created extensions and 5 extensions bought from legitimate authors. They implement different utility tools: SEO stats checkers, crypto price monitors, screen utilities, and ad spying tools.

The “Enable Right Click & Copy — Smart Unlock + OCR“ extension has the largest potential impact. It was initially developed by a legitimate organization, PreppHint, before eventually being acquired by the threat actor. At the time when the malicious functionality was introduced, the extension had around 70,000 users. While that does not necessarily mean all of the users had the malicious version installed, it still represents a significant exposure surface. This is especially true given that the Chrome extension update settings default to auto-updating to the latest version of the extension at startup and periodically every few hours. Combined with the Edge version of the extension, which contains the same malware and has around 10,000 users, this extension has a potential impact surface of 80,000 users.

At the moment of writing, the Chrome extension was already identified as malicious and removed from the Chrome Web Store, but the Edge version of the extension is still active and serving malware. The finding has been reported to the Edge extension store. Initially both Chrome and Edge versions of the extension used the same C2 domain, but after the Chrome extension got identified as malware, a new version of the Edge extension was published with an updated C2 domain on August 14th, 2026.

All of the identified extensions use similar code execution techniques and contain recognizable code patterns. While this C2 communication and code execution framework is shared across all the extensions, the pluggable design indicates that the final payload is highly modifiable and likely changes over the time. But the ultimate targets and motivation most likely remain the same - wallet secret stealing and crypto draining.

All of the malicious code extensions follow the same design patterns and they are easily recognizable in code across different extensions.

The background service worker uses a consistent data structure for managing C2 communication and job orchestration. It stores information userId, connection and execution timings and downloaded code modules ( nodes ) using the dedicated Chrome extension local storage API ( chrome.storage ).

The background service worker establishes a communication channel to the C2 server. The latest malware versions build and maintain a persistent WebSocket connection, with 5-minute heartbeat interval, while all errors are silently swallowed. Worth noting is that the loading framework supports rotation of the C2 endpoint based on instructions received from the initial C2 server and this behavior has been observed in the wild. That functionality enables threat actors to distribute victims to different groups and dedicated C2 infrastructure and to reduce the detection risk. Data exfiltration endpoint is also dynamically received from the C2 instructions enabling a per-victim exfiltration channel.

Incoming WebSocket messages deliver malicious modules in form of JavaScript snippets that get encrypted and stored in the nodes Chrome local storage key. The communication is encrypted with AES-GCM using a key derived from SHA-256 hash of the extensionId and installUUID.

The Content Security Policy (CSP) header tells the browser which dynamic resources, scripts, and domains are trusted and allowed to execute, acting as a primary defense against cross-site scripting (XSS) and data injection. On startup the background service worker registers a dynamic declarativeNetRequest browser rule that strips Content-Security-Policy headers from every page, all frames, and on every site the user visits. CSP stripping is necessary to enable the injection technique used to include malicious JavaScript code modules on targeted websites.

The threat actors use all of the mechanisms provided by Chrome extension architectural design to implement the malware loading framework. Chrome extensions typically define a background worker responsible for logical or time-costly operations, and content scripts that run in the context of web pages and can interact with and modify content of the visited websites. They use the concept of “Message Passing” chrome.runtime.sendMessage to establish communication with the background service worker. The data can also be passed between the content scripts and service workers by using the Chrome extension storage API .

Content scripts can be defined statically or dynamically. Older versions of malware samples defined the content scripts statically in the extension’s manifest.json file to automatically run whenever a user visits any webpage by defining a wildcard matching pattern. That technique can be noisy and easier to spot then triggering the script injection dynamically via chrome.scripting.executeScript which is observed in newer versions of the malware.

With the CSP protections previously stripped, content scripts are used by the malware loading framework to trigger the execution of malicious JavaScript code modules. These are the same modules which the background service worker previously downloaded from the C2 server and stored to the Chrome extension storage API. Content scripts create hidden DOM elements ( , , ) in the websites that user visits. Malicious modules are defined as event handlers for these hidden elements, allowing them to be executed in the main world. In the Chrome browser, the main world is the default execution environment where a web page's own JavaScript and webpage scripts run. While it shares DOM access with extensions, it maintains a separate JavaScript heap from the isolated worlds used by browser extensions. Finally, once everything is set up, a new event for the defined event handler is generated, forcibly triggering the execution of the malicious module. The previously created element is then immediately removed to avoid leaving evidence.

Everything described until this point explains how the malware loading framework works. The actual payloads that perform malicious operations are highly extensible and change over time. Details are provided for the modules observed in the communication with the C2 server defined in the “Enable Right Click & Copy — Smart Unlock + OCR” extension. As mentioned earlier, the main focus of operations is wallet secret stealing and crypto draining. The observed list includes 16 modules which can be divided into several groups.

1. Multi-chain wallet drainer.

Detects EVM, Solana and Tron wallets. Loads a chain-specific second stage from a dedicated domain ( cookie-whitelist.top , whale-alert.art ) then hijacks the site’s real “Connect Wallet” / “Swap” buttons. It clones the button to strip the site’s own handlers, attaches threat actor defined handlers, dismisses the genuine wallet dialog, and drives the connect/approve flow to authorize theft.

2. Hardware-wallet seed-phrase phishing (superior-trezor / superior-ledger).

On trezor.io and ledger.com it performs a full-page DOM takeover, fetching a pixel-accurate fake “Ledger Live / Trezor” update-and-restore wizard from a dedicated content serving domain ggle-analytics.com . The flow walks the victim through entering their 12/18/24-word recovery phrase, which is captured and exfiltrated. Stolen phrase leads to the complete compromise of the underlying wallet.

3. Exchange & wallet account harvesters.

This group includes session-riding modules that read balances and authenticated session material (cookies, bearer/authorization tokens, account/profile data) directly from the victim’s logged-in tabs. Targeted services are OKX, MEXC, Kraken, KuCoin, Coinbase, Binance, Bybit, and MetaMask. The collected information represents both portfolio intelligence and the session material needed for account takeover.

4. Universal credential/form grabber (superior-grabber).

This module hooks focus, input, change, blur, and mutation events across every text, password and email input on every page, including same-origin iframes. It captures input values, groups them into batches, and exfiltrates them at predefined time intervals together with page fingerprint data.

5. Social-media theft.

A module harvests access tokens, business, billing and professional-dashboard data. A module registers a rogue in-page service worker to strip anti-CSRF headers and abuse the logged-in session.

6. Browser-history exfiltration (superior-history).

A Dedicated module exfiltrates the victim’s browsing history.

7. ClickFix fake-update lures (superior-updater).

This module injects a fake browser-update page, modal or bar from a dedicated content serving domain ggle-analytics.com . It implements decoy behavior - without expected referrers or user-agents browser headers it serves alternative content. One lure displays a fake “Chrome — Update available” page that copies an attacker-supplied command to the clipboard, then uses OS-specific screenshots to instruct the victim to paste and run it.

As explained, this list is not exhaustive nor final. The malware is evolving over time and new payloads are expected.

Socket is tracking this campaign under the name “Superior” based on the tags observed in the names of the malicious JavaScript modules. The beginning of the campaign dates back to February 2024. This conclusion is based on the similarities observed in techniques and operational methods that overlap with a threat research investigation conducted by DomainTools. Beside the operational similarities and code techniques, domain naming similarity has also been observed. A significant number of domains in both research investigations use the .top top-level domain for primary C2 hosting. The second major similarity is in domain naming. Examples include the servers used for hosting of wallet drainer scripts:

The threat actor behind this campaign is determined to keep the campaign alive and active and has been successfully doing it for more than 2 years. An advanced architectural design and a very well consolidated background operational system proves that this is the work of a very capable threat actor. Separation of logic responsible for the malware operation from the actual implementation of malicious functionalities delivered through the malicious modules helps reduce the detection risk and keep the campaign under the radar.

Support for C2 rotation and delegation from the primary C2 server, together with distinct communication channels for data exfiltration and delivery of additional malicious scripts, helps keep the campaign operational even after the initial compromise gets discovered and the primary C2 server gets taken down.

The biggest risk for end-users is the operational technique in which the threat actor successfully acquires legitimate extensions and releases new versions empowered with malicious functionality. That approach, combined with Chrome's default extension update settings , performs auto-updating to the latest version of extension, providing the threat actor with a powerful vector to maximize the impact and reach of the extension acquisition. If an extension with 10,000 users can be bought for less than $2,000 then it represents an attractive opportunity for the threat actor. Another problem is that extension users don’t get notified when extension ownership gets changed, leaving them unaware of the risk level that suddenly increased.

Extension users need to exercise caution when installing extensions. Continual monitoring is vital because a reliable tool can change instantly. Review your installed extensions regularly and remove any you don’t need or find suspicious to narrow the exposed surface. Think twice before you decide to add a new extension to your browser. Ask yourself: Is it really necessary?

While we primarily observed this campaign in the Chrome extension ecosystem, the discovery of the latest malicious Edge extensions proves that it has expanded to Microsoft Edge.

These are legitimate extensions with proper functionality, which were acquired by the threat actor at some moment and then powered up with the malicious functionality.