Nineteen browser extensions for Google Chrome and Microsoft Edge were used to deliver a modular malware framework capable of draining cryptocurrency wallets, stealing credentials and account data, extracting browser history, and displaying ClickFix-style lures.
Application security company Socket identified 18 malicious Chrome extensions and one Microsoft Edge extension as part of a campaign it says may have been operating since February 2024. The extensions contained separate JavaScript modules for different forms of data theft and could receive additional payloads from attacker-controlled infrastructure.
Several of the extensions initially provided the functionality described on their store listings and did not contain malicious code when first published. Socket found that five legitimate extensions were later acquired from their original developers and modified to include the malware. Malicious functionality was then distributed through updates, allowing existing users to receive the altered code without installing a new extension.
One affected extension, “Enable Right Click & Copy — Smart Unlock + OCR,” had at least 70,000 Chrome users when the malicious version appeared. Its Microsoft Edge version had around 10,000 users at the time.
The extensions connect to command-and-control servers through encrypted WebSocket connections. The servers can provide JavaScript modules to the extensions, allowing the operators to add or change functionality without replacing the entire extension. Socket found that the downloaded modules were encrypted before being stored locally and that the framework could use changing C2 infrastructure.
The malware also interferes with protections built into websites. It removes Content Security Policy headers from pages visited by the user, weakening restrictions that can prevent unauthorized scripts and other resources from executing. It then injects malicious JavaScript into websites using hidden HTML elements, giving the attackers a way to interact with pages opened by the victim.
Socket identified 16 malicious modules with different capabilities.
One group of modules targets cryptocurrency wallets across Ethereum Virtual Machine-compatible networks, Solana and Tron. The malware can interfere with legitimate “Connect Wallet” and “Swap” buttons, redirecting transactions or wallet connections to attacker-controlled destinations.
Another module targets users visiting Ledger and Trezor websites. Instead of allowing the legitimate pages to operate normally, the malware can replace them with convincing phishing pages designed to obtain wallet recovery seed phrases. Access to a seed phrase can give an attacker control over the associated cryptocurrency wallet.
The framework also targets cryptocurrency services including Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit and MetaMask. Its modules can collect session information, authentication tokens, account details and wallet balances from these services.
Credential theft extends beyond cryptocurrency platforms. A separate component can record information entered into forms across websites, including usernames, passwords and other form data. Additional modules collect information associated with Facebook and LinkedIn accounts, while another extracts browser history.
The campaign also incorporates ClickFix-style social engineering. The malware can display fake browser-update messages that instruct users to perform actions on their computers. In the observed implementation, the attacker can place a command in the clipboard and persuade the victim to paste and execute it. This technique shifts part of the attack from automated browser compromise to user-assisted execution.
The extension acquisition strategy adds another layer to the campaign. Browser extensions can receive updates after installation, meaning users who originally downloaded a legitimate utility may later receive altered code. Chrome's extension update process can automatically check for and install updates, so the user does not necessarily need to revisit the Chrome Web Store for the malicious version to reach an existing installation.
Google removed the identified malicious extensions from the Chrome Web Store. Socket also reported the Microsoft Edge extension to Microsoft. At the time of Socket's investigation, however, the Edge version remained available and its operators had changed the C2 domain used by the malware.
Socket said the 16 modules it identified may not represent the framework's complete capabilities. Its modular design allows operators to introduce additional functionality and deploy new payloads through the C2 infrastructure.
Users who installed any of the affected extensions should remove them and treat credentials entered while the extensions were active as potentially exposed. Passwords for affected accounts should be changed, with additional authentication protections enabled where available.
Cryptocurrency users whose wallets may have been exposed should consider the wallet compromised and transfer remaining assets to a newly created wallet with a newly generated recovery phrase.
