Socket finds 19 Chrome and Edge extensions with crypto-stealing code
This digest was compiled by AI from multiple sources — links to the originals are below.
Socket researchers identified 19 browser extensions—18 for Chrome and one for Edge—that steal wallet secrets and drain cryptocurrency. The extensions were published over the last six months, with evidence the campaign dates to February 2024. The threat actor acquired five extensions and created 14, pushing malicious updates after gaining users.
Key Facts
- Socket security researcher Karlo Zanki identified 19 extensions with wallet-stealing and crypto-draining code.
- The campaign has been active since February 2024, according to Socket.
- 14 extensions were created by the threat actor, and five were purchased from previous owners.
- The QuickLens extension was previously flagged by Annex Security and monxresearch-sec for pushing malware and harvesting data.
- DomainTools Investigations documented aspects of the campaign in May 2025.
Extension Cluster
Socket identified 18 Chrome extensions and one Microsoft Edge extension with malicious capabilities. The extensions share similarities in code and tradecraft, indicating a coordinated campaign. Socket is tracking the activity under the name Superior. The threat actor either acquired legitimate extensions or published clean versions before adding malicious updates.
Extension Acquisition
Five extensions were purchased from their previous owners, including Enable Right Click & Copy, RapidLens, QuickLens, Password Protect PDF, and Allow Copy. The QuickLens extension was previously flagged by Annex Security and monxresearch-sec for pushing malware and harvesting sensitive data. The remaining 14 extensions were created and published by the threat actor.
Campaign Timeline
Socket's findings indicate the campaign has been ongoing since February 2024. DomainTools Investigations documented some aspects of the campaign in May 2025. The latest findings suggest the activity is broader in scope than previously thought.
2 sources
Socket finds 19 Chrome and Edge extensions with crypto-stealing code
