Nineteen Chrome and Edge extensions turned malicious via updates to steal wallets and credentials

A campaign dubbed "Superior" by Socket Threat Research turned the browser extension update mechanism into a delivery channel for credential and cryptocurrency theft, according to a BleepingComputer report summarised on dev.to on August 30, 2026. Nineteen extensions available through the Chrome Web Store and Microsoft Edge Add-ons were either published as genuinely harmless tools or acquired from their original developers, then pushed a malicious update after a user base had accumulated.

The core problem is structural: browsers update installed extensions automatically by default, and stores do not explicitly tell users when an extension changes ownership. The code a reviewer or user sees at install time is not necessarily the code that runs later.

How the attack works

According to the report, the loader sits in the extension's background service worker. After installation or update it generates a unique identifier for that installation and opens a WebSocket connection to a command-and-control server. JavaScript modules returned over that channel are written to chrome.storage.local, encrypted with AES-GCM using a key derived from the extension ID and the per-installation UUID.

To execute on real websites, the extension registers dynamic declarativeNetRequest rules that strip Content-Security-Policy response headers from pages the user visits. Content scripts then attach the retrieved code to a hidden DOM element as an event handler and fire the event, running the payload in the main world of the page — the same JavaScript context as the legitimate site. From there, behaviour varies depending on the target site and what the user is doing.

What the modules steal

The report attributes a wide range of theft capabilities to the downloaded modules:

• Connection and swap operations for EVM, Solana and Tron wallets are hijacked, pushing users toward approving transfers to attacker-controlled addresses.
• Full-screen pages imitating the official Ledger and Trezor interfaces request 12-, 18- or 24-word recovery phrases, which compromise the entire wallet.
• Sessions, tokens, account details and balance information are collected for Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit and MetaMask.
• Usernames, passwords, email addresses and form input values are harvested from fields on arbitrary sites.
• Facebook and LinkedIn account data, plus overall browsing history, are transmitted out.

The campaign also deploys ClickFix-style fake Chrome update prompts. Users who follow the instructions paste commands from their clipboard that execute locally on the device, taking the compromise outside the browser entirely.

What administrators and users can do

The write-up recommends removing and blocking the known malicious extension IDs and pruning unnecessary high-privilege extensions from managed browsers. Enterprise environments should enforce extension allowlists and monitor for ownership or permission changes, since a previously vetted extension can silently change hands.

On the network side, defensible indicators include WebSocket and HTTPS traffic from extension processes to C2 infrastructure, with the report naming domains on .top, .pro and .sbs TLDs as well as Cloudflare Workers used for exfiltration — examples such as ws[.]site-signal[.]top and ggle-analytics[.]com are listed. Endpoint detection should flag shells or script environments spawning directly from the browser, particularly right after clipboard activity. Identity providers and crypto services warrant checks for reused sessions, unusual devices or locations, and changes to MFA or recovery settings.

For individual users, the guidance is simpler: treat any prompt asking you to paste and run a command, or to enter a wallet recovery phrase into a web page, as malicious regardless of how legitimate it looks.

Why it matters

This incident exposes a gap in the browser extension trust model rather than a single exploit. Users who carefully vetted an extension at install time were still compromised, because the threat arrived through the same signed, auto-applied update channel they rely on for security patches. Acquisition-based attacks make this worse: an extension's reputation can be effectively purchased and weaponised without any visible signal to its existing users.

For security teams, it argues for treating extension inventories as continuously monitored assets — tracking IDs, versions, permissions and ownership over time — instead of one-time approvals. For anyone holding cryptocurrency, it is a reminder that even hardware wallet seed phrases can be phished through a compromised browser, and that no page requesting a recovery phrase should ever be trusted.