Malicious Chrome and Edge Extensions Target Crypto Users

• •19 extensions compromised, affecting Chrome and Edge users.
• •Attackers acquired legitimate extensions, later introducing malware.
• •The campaign has been active since February 2024, indicating a long-term threat.

A coordinated malware campaign has compromised 19 browser extensions—18 for Chrome and 1 for Edge—designed to steal cryptocurrency wallet secrets and login credentials. The campaign, named 'Superior,' has been active since February 2024 and uses a strategy where legitimate extensions are acquired and later weaponized. The most impactful extension, 'Enable Right Click & Copy — Smart Unlock + OCR,' had around 80,000 users before malicious code was introduced. Attackers utilize techniques such as establishing persistent WebSocket connections and injecting hidden scripts to exfiltrate sensitive data. While the Chrome version of the extension has been removed, the Edge version remains active. The malicious extensions have been linked to a broader campaign that has evolved over time, indicating a sustained effort to exploit users. Researchers are tracking the operation closely due to its potential widespread impact on users' security.