--- title: 19 Chrome and Edge Extensions Deliver a Wallet Drainer... description: Socket's threat research team uncovered 19 Chrome and Edge extensions (18 Chrome, 1 Edge) delivering a modular malware framework focused on crypto wallet... canonical: https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads | daily.dev og:description: Socket's threat research team uncovered 19 Chrome and Edge extensions (18 Chrome, 1 Edge) delivering a modular malware framework focused on crypto wallet... og:url: https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi og:image: https://api.daily.dev/og/posts/JDMSPmWBI.png og:image:alt: 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads **[Socket](https://daily.dev/sources/socketdev)** · 14 min read · 1 upvotes · 0 comments ## Summary Socket's threat research team uncovered 19 Chrome and Edge extensions (18 Chrome, 1 Edge) delivering a modular malware framework focused on crypto wallet draining and credential theft. Threat actors either built utility extensions themselves or acquired legitimate ones with existing user bases, then pushed malicious updates exploiting Chrome's auto-update mechanism. The malware strips Content-Security-Policy headers via declarativeNetRequest, establishes an encrypted WebSocket C2 channel, and injects JavaScript modules into visited pages to steal wallet seed phrases, exchange session tokens, credentials, and browsing history. The campaign, dubbed 'Superior' by Socket, traces back to February 2024 and overlaps with a prior DomainTools investigation, with the most impactful extension reaching a combined 80,000 users across Chrome and Edge. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do malicious Chrome extensions bypass Content Security Policy to inject scripts on visited websites? They register a dynamic declarativeNetRequest rule on startup that strips Content-Security-Policy headers (including CSP-Report-Only, X-WebKit-CSP, and X-Content-Security-Policy) from every page, frame, and site the user visits. With CSP protections removed, content scripts can inject hidden DOM elements like input or img tags with event handlers that execute malicious JavaScript modules previously downloaded from a command-and-control server. _daily.dev surfaces security research like this for teams auditing browser extension attack techniques._ ### Why did the Enable Right Click & Copy Chrome extension get flagged as malware? It was a legitimate extension built by PreppHint that was later acquired by a threat actor and updated with malicious wallet-draining and credential-stealing code while retaining roughly 70,000 Chrome users and 10,000 Edge users, for a combined exposure of about 80,000 users. Chrome removed the malicious version from its store, but the Edge version remained active with an updated C2 domain published August 14, 2026. _Track extension supply-chain incidents like this one on daily.dev before installing browser add-ons._ ### How much does it cost attackers to buy a popular Chrome extension for a supply chain attack? An extension with around 10,000 users can reportedly be bought for less than $2,000, making acquisition of established extensions an attractive and low-cost attack vector. Once purchased, attackers push an update carrying malicious functionality, relying on Chrome's default auto-update behavior to distribute the payload to the existing user base without any new-install friction or ownership-change notification. _daily.dev helps developers keep tabs on extension marketplace risks like acquisition-based supply chain attacks._ --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#devtools](https://daily.dev/tags/devtools), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads","url":"https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi"},"datePublished":"2026-08-27T17:50:28.809Z","dateModified":"2026-08-30T14:26:38.243Z","description":"Socket's threat research team uncovered 19 Chrome and Edge extensions (18 Chrome, 1 Edge) delivering a modular malware framework focused on crypto wallet...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/49a13a91dce02ccd60bf6d35bf112689?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/49a13a91dce02ccd60bf6d35bf112689?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,devtools,malware","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads-jdmspmwbi#faq","mainEntity":[{"@type":"Question","name":"How do malicious Chrome extensions bypass Content Security Policy to inject scripts on visited websites?","acceptedAnswer":{"@type":"Answer","text":"They register a dynamic declarativeNetRequest rule on startup that strips Content-Security-Policy headers (including CSP-Report-Only, X-WebKit-CSP, and X-Content-Security-Policy) from every page, frame, and site the user visits. With CSP protections removed, content scripts can inject hidden DOM elements like input or img tags with event handlers that execute malicious JavaScript modules previously downloaded from a command-and-control server. daily.dev surfaces security research like this for teams auditing browser extension attack techniques."}},{"@type":"Question","name":"Why did the Enable Right Click & Copy Chrome extension get flagged as malware?","acceptedAnswer":{"@type":"Answer","text":"It was a legitimate extension built by PreppHint that was later acquired by a threat actor and updated with malicious wallet-draining and credential-stealing code while retaining roughly 70,000 Chrome users and 10,000 Edge users, for a combined exposure of about 80,000 users. Chrome removed the malicious version from its store, but the Edge version remained active with an updated C2 domain published August 14, 2026. Track extension supply-chain incidents like this one on daily.dev before installing browser add-ons."}},{"@type":"Question","name":"How much does it cost attackers to buy a popular Chrome extension for a supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"An extension with around 10,000 users can reportedly be bought for less than $2,000, making acquisition of established extensions an attractive and low-cost attack vector. Once purchased, attackers push an update carrying malicious functionality, relying on Chrome's default auto-update behavior to distribute the payload to the existing user base without any new-install friction or ownership-change notification. daily.dev helps developers keep tabs on extension marketplace risks like acquisition-based supply chain attacks."}}]} ```