--- title: 19 Chrome and Edge Extensions Deliver a Wallet Drainer... description: Socket's threat research team uncovered 19 Chrome and Edge extensions (18 Chrome, 1 Edge) delivering a modular malware framework focused on crypto wallet... canonical: https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads | daily.dev og:description: Socket's threat research team uncovered 19 Chrome and Edge extensions (18 Chrome, 1 Edge) delivering a modular malware framework focused on crypto wallet... og:url: https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi og:image: https://api.daily.dev/og/posts/JDMSPmWBI.png og:image:alt: 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads **[Socket](https://daily.dev/sources/socketdev)** · 14 min read · 1 upvotes · 0 comments ## Summary Socket's threat research team uncovered 19 Chrome and Edge extensions (18 Chrome, 1 Edge) delivering a modular malware framework focused on crypto wallet draining and credential theft. Threat actors either built utility extensions themselves or acquired legitimate ones with existing user bases, then pushed malicious updates exploiting Chrome's auto-update mechanism. The malware strips Content-Security-Policy headers via declarativeNetRequest, establishes an encrypted WebSocket C2 channel, and injects JavaScript modules into visited pages to steal wallet seed phrases, exchange session tokens, credentials, and browsing history. The campaign, dubbed 'Superior' by Socket, traces back to February 2024 and overlaps with a prior DomainTools investigation, with the most impactful extension reaching a combined 80,000 users across Chrome and Edge. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do these malicious Chrome extensions bypass Content Security Policy to inject malicious scripts? They register a dynamic declarativeNetRequest rule on startup that strips Content-Security-Policy, X-WebKit-CSP, and X-Content-Security-Policy headers from every page, frame, and site the user visits. With CSP protections removed, content scripts can inject hidden DOM elements with malicious event handlers that execute attacker-supplied JavaScript modules previously downloaded from a command-and-control server. _Anyone auditing browser extension permissions can track emerging extension-based attack techniques on daily.dev._ ### Why did a Chrome extension with 70,000 users suddenly start stealing crypto wallet data? The 'Enable Right Click & Copy — Smart Unlock + OCR' extension was originally built by legitimate developer PreppHint, then acquired by a threat actor who pushed a malicious update once the extension had established trust and a large user base. Combined with its Edge version's 10,000 users, the extension had a potential impact surface of 80,000 users, and Chrome's default auto-update behavior spread the malicious version silently. _Developers evaluating extension supply-chain risk can follow campaigns like this on daily.dev._ ### What kind of data do the modules in the Superior malware campaign steal from infected browsers? The campaign uses 16 identified modules covering multi-chain wallet draining (EVM, Solana, Tron), hardware wallet seed-phrase phishing on trezor.io and ledger.com, session-cookie harvesting from exchanges like OKX, Kraken, Coinbase, and Binance, a universal credential grabber hooking form inputs across every page, Facebook and LinkedIn token theft, browsing history exfiltration, and fake browser-update ClickFix lures. _Security teams tracking crypto-targeted malware techniques can follow research breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [108 Chrome Extensions Linked to Data Exfiltration and Sessio...](https://daily.dev/posts/108-chrome-extensions-linked-to-data-exfiltration-and-sessio--r4tdhhzt9) · Socket · 4 upvotes · 1 comments - [Malware bypasses browser checks to force install Chrome, Edge extensions](https://daily.dev/posts/malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions-hxlx1l2zf) · BleepingComputer · 1 upvotes · 0 comments - [Newly discovered malicious extensions could be lurking in enterprise browsers](https://daily.dev/posts/newly-discovered-malicious-extensions-could-be-lurking-in-enterprise-browsers-i20gceevx) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#devtools](https://daily.dev/tags/devtools), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads","url":"https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi"},"datePublished":"2026-08-27T17:50:28.809Z","dateModified":"2026-09-14T09:14:25.244Z","description":"Socket's threat research team uncovered 19 Chrome and Edge extensions (18 Chrome, 1 Edge) delivering a modular malware framework focused on crypto wallet...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/49a13a91dce02ccd60bf6d35bf112689?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/49a13a91dce02ccd60bf6d35bf112689?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,devtools,malware","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi#faq","mainEntity":[{"@type":"Question","name":"How do these malicious Chrome extensions bypass Content Security Policy to inject malicious scripts?","acceptedAnswer":{"@type":"Answer","text":"They register a dynamic declarativeNetRequest rule on startup that strips Content-Security-Policy, X-WebKit-CSP, and X-Content-Security-Policy headers from every page, frame, and site the user visits. With CSP protections removed, content scripts can inject hidden DOM elements with malicious event handlers that execute attacker-supplied JavaScript modules previously downloaded from a command-and-control server. Anyone auditing browser extension permissions can track emerging extension-based attack techniques on daily.dev."}},{"@type":"Question","name":"Why did a Chrome extension with 70,000 users suddenly start stealing crypto wallet data?","acceptedAnswer":{"@type":"Answer","text":"The 'Enable Right Click & Copy — Smart Unlock + OCR' extension was originally built by legitimate developer PreppHint, then acquired by a threat actor who pushed a malicious update once the extension had established trust and a large user base. Combined with its Edge version's 10,000 users, the extension had a potential impact surface of 80,000 users, and Chrome's default auto-update behavior spread the malicious version silently. Developers evaluating extension supply-chain risk can follow campaigns like this on daily.dev."}},{"@type":"Question","name":"What kind of data do the modules in the Superior malware campaign steal from infected browsers?","acceptedAnswer":{"@type":"Answer","text":"The campaign uses 16 identified modules covering multi-chain wallet draining (EVM, Solana, Tron), hardware wallet seed-phrase phishing on trezor.io and ledger.com, session-cookie harvesting from exchanges like OKX, Kraken, Coinbase, and Binance, a universal credential grabber hooking form inputs across every page, Facebook and LinkedIn token theft, browsing history exfiltration, and fake browser-update ClickFix lures. Security teams tracking crypto-targeted malware techniques can follow research breakdowns like this on daily.dev."}}]} ```