"Worth noting is the loading framework supports rotation of the C2 endpoint based on instructions received from the initial C2 server and this behavior has been observed in the wild," Socket security researcher Karlo Zanki explained.
How the campaign operates
Security researchers at Socket discovered a cluster of 18 Google Chrome extensions and one Microsoft Edge extension that, after a period of benign operation, began delivering wallet-secret stealing and crypto-draining capabilities. Socket is tracking the activity under the name Superior and reports evidence the campaign may have been active since February 2024. The attackers either acquired legitimate extensions or published initially clean versions; once the extensions amassed users, new versions with malicious behavior were pushed to victims.
Which extensions were involved and how many users are exposed
Socket's analysis shows 14 of the identified extensions were created by the threat actor and five were bought from previous owners. The extensions purchased by the actor include:
- koccklolohdacbfooifnpebakpbeipc — Enable Right Click & Copy — Smart Unlock + OCR
- fegckejpfnlmfgkfjpinlbgmeeijjkel — RapidLens - Google Lens for Screen Search & Images
- kdenlnncndfnhkognokgfpabgkgehodd — QuickLens - Search Screen with Google Lens
- jamminefolhgepgihbmcjjhgldbfcikp — Password Protect PDF
- inmkjedjdhgpknjogbjomhnbgdccckkg — Allow Copy - Select & Enable Right Click (Microsoft Edge)
Extensions created and published by the threat actor include items such as PixelCheck, Private Crypto News Reader, Blockfolio: Address Monitor, LedgerLook: Wallet Checker, and many others listed in Socket's findings. The extension "Enable Right Click & Copy — Smart Unlock + OCR" alone has a collective install base of 80,000 users across Chrome and Edge, making it the single extension with the most potential impact.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMalicious capabilities: modules, CSP stripping, and persistent C2
Socket and related reporting identify a multi-stage technical profile: each malicious extension is capable of contacting command-and-control (C2) servers and maintaining a persistent WebSocket connection. Zanki noted the loading framework can rotate C2 endpoints based on instructions received from an initial server, enabling per-victim routing to different infrastructure and lowering detection risk.
Several technical behaviors were documented in at least some extensions. Malicious code can strip Content Security Policy (CSP) headers from pages and inject JavaScript modules into targeted websites through content scripts. Socket identified 16 modules; categories include multi-chain wallet drainers, hardware-wallet seed-phrase harvesters, cryptocurrency exchange and wallet account harvesters, universal credential or form grabbers, Facebook and LinkedIn account stealers, browser history stealers, and a ClickFix-style lure.
The ClickFix module specifically injects a fake web browser update and uses operating-system-specific instructions to trick victims into copying and pasting a malicious command.
Previous flags and the campaign's timeline
The extension QuickLens — listed by Socket as kdenlnncndfnhkognokgfpabgkgehodd — was previously flagged earlier this year by Annex Security and monxresearch-sec for its ability to push malware, inject arbitrary code, and harvest sensitive data. DomainTools Investigations documented aspects of the broader campaign in May 2025, noting that the threat actor created fake websites posing as legitimate services (productivity tools, VPNs, cryptocurrency utilities and others) to trick users into installing malicious extensions from the Chrome Web Store.
DomainTools summarized the operational pattern succinctly: "The extensions typically have a dual functionality, in which they generally appear to function as intended, but also connect to malicious servers to send user data, receive commands, and execute arbitrary code."
What this means for technologists, regulators, and end users
- Technologists and security teams: Monitor for extensions that change behavior after initial publication—especially those that begin making persistent WebSocket connections to remote hosts, strip CSP headers, or load external modules. The presence of modules matching the identified categories (wallet drainers, seed-phrase harvesters, universal form grabbers) should raise immediate alarms.
- Policymakers and platform regulators: The campaign highlights how acquiring legitimate extensions and shipping malicious updates leverages Chrome's default extension auto-update behavior. Regulators and platform owners will be watching the acquisition and update pathways that allowed attackers to broaden reach after initial installation.
- End users: Extensions that request broad permissions, or that were recently updated after a long period of benign operation, may warrant caution—particularly extensions with significant install bases, such as the 80,000 installs tied to the Enable Right Click & Copy offering. The ClickFix lure demonstrates attackers are willing to prompt manual execution of commands via copy/paste social engineering.
Exactly who is behind Superior remains unknown. Socket characterizes the operator as a "very capable threat actor" given the campaign's longevity and operational sophistication. The combination of legitimate extension acquisition, default auto-updating, dynamic per-victim exfiltration channels, and a library of targeted modules makes this a case study in how browser extensions can be abused at scale.
Read the original report: https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html
