Five Chrome Extensions Were Bought From Their Authors, Then Poisoned by Update

31 AUG 2026 — Socket has identified 19 browser extensions running a wallet-stealing campaign it calls Superior, active since February 2024. Fourteen were built by the operator. The other five were bought from their original authors and turned malicious by an automatic update, which means store review never had a chance to catch them.

What was found

Socket researcher Karlo Zanki counts 19 extensions, 18 on Chrome and one on Edge, carrying 16 distinct malicious modules between them. The largest, an accessibility tool called Enable Right Click and Copy with smart unlock and optical character recognition, reached roughly 80,000 installations across the two stores.

Others include RapidLens, QuickLens, Password Protect PDF and crypto-adjacent tools named Blockfolio Address Monitor and Crypto Alerter. Counts differ between accounts — one report describes 19 malicious modules rather than 19 extensions carrying 16 — and we have used Socket's own breakdown.

The modules are specialised and separately deployable: a multi-chain wallet drainer, a hardware-wallet seed-phrase harvester, an exchange and wallet account harvester, a universal credential and form grabber, Facebook and LinkedIn account stealers, a browser history stealer, and a ClickFix-style lure that shows a fake browser-update prompt asking the user to paste a command. Targets include Ethereum-compatible, Solana and Tron wallets, and credentials for Coinbase, Binance, Kraken and MetaMask.

One behaviour deserves separate mention. The malware strips the Content Security Policy header from every page the browser loads, then injects its own scripts through content scripts and hidden elements. CSP is the mechanism a website uses to declare which scripts may run on it, and an extension operating at this privilege level can simply delete that declaration before the page is parsed. A site's own defences are removed on the way in, and the site never learns it happened.

The acquisition route is the part that matters

Most extension malware stories are store review failures, and for extensions that were malicious on publication that is fair. For these five the story is different, and the distinction changes what users and administrators can do.

Those five were legitimate. Someone else wrote them, and they were published, reviewed, installed and used, building up the ratings and install counts that make an extension look safe. Then the account was sold, and the malicious code arrived through the ordinary automatic update channel that every browser applies silently by default.

A user who installed one of them made a correct decision on the available evidence. That decision became wrong later, without any action on their part and without any signal they could have seen. Store review happens at submission. Ownership transfer does not go back through it.

Why the permission model does not save you here

An extension's manifest declares what it can reach, and we have argued before that reading it is the single most useful thing a user can do — we read the manifests of a set of popular extensions to show what the declarations actually permit.

That advice still holds and it does not cover this case. A right-click-unlock tool needs to run on every page by definition, because unlocking a page is the function. Its permissions were appropriate to what it honestly did, and those same permissions are exactly what a credential stealer wants. The manifest did not have to change for the behaviour to change.

Permission review tells you what an extension could do if it turned hostile, not whether it has. Once an extension with broad host permissions is installed, the update channel is a standing authority to run new code inside every page you visit, and the model never requires that authority to be re-earned.

Removal does not propagate between stores

Google removed the identified extensions from the Chrome Web Store. Edge versions were reported to be still available at the time of publication.

The gap is structural, not a case of either vendor missing something. The Edge add-ons store is a separate catalogue with a separate review pipeline, and an extension published to both is two listings with no shared takedown mechanism. A detection reported to one vendor does not propagate to the other.

The exposure here is narrow, because this campaign was almost entirely a Chrome operation and only one of the 19 listings was on Edge. The principle is not narrow. For an organisation managing browsers, a removal announcement from one vendor applies only to that vendor's store, so an advisory naming the Chrome Web Store says nothing about whether the same extension is still installable and still updating on an Edge fleet.

What to actually do about it

The controls that work here are unglamorous and mostly about reducing standing authority.

Audit what is installed, not what was approved. Extensions accumulate, ownership changes are not announced, and an inventory taken a year ago describes a different set of code from the one running today. Count how many extensions have host permissions on all sites. The answer is usually higher than you would guess.

Separate the browser that touches wallets and exchange accounts from the browser that has extensions in it. This recommendation works because the payload's value depends on being in the same browser profile as the credentials.

And treat a browser-update prompt inside a web page as hostile by default. The ClickFix pattern works because it asks the user to run a command themselves, which converts a page into code execution without any browser vulnerability at all. A real browser update never arrives that way.

Why this reaches this region particularly

Cryptocurrency ownership is high across Southeast Asia relative to population, and browser extensions are how most retail holders interact with a wallet.

A campaign that targets MetaMask and impersonates Ledger and Trezor is aimed at self-custody, which is the segment least able to reverse a loss. There is no chargeback, no support desk with authority, and generally no regulator with jurisdiction over the counterparty. The exchange-credential half of the payload is at least theoretically recoverable; the wallet half is not.

Advice about extensions rarely gives this asymmetry enough weight. The cost of a compromised browser is not uniform, and it is highest for the users this campaign went after.