Socket Uncovers 19 Malicious Chrome and Edge Extensions Stealing Crypto Wallets and Credentials

Socket researchers have uncovered a sprawling malware campaign hidden inside 19 browser extensions for Google Chrome and Microsoft Edge. Furthermore, the malicious framework steals cryptocurrency wallet secrets, harvests credentials, and injects ClickFix-style lures into websites visited by victims. Some extensions were originally legitimate tools that attackers acquired and weaponized through automatic updates, giving the campaign a potential reach of over 80,000 users.

What Happened: Attackers Weaponize Chrome and Edge Extensions for Crypto Theft

On August 27, 2026, application security firm Socket published findings from its Threat Research team. The team identified 18 malicious Chrome extensions and one Edge extension that shared code patterns, command-and-control infrastructure, and operational techniques. Moreover, the investigation traced connections to a campaign first reported by DomainTools in February 2024 and later analyzed by Secure Annex.

The operation follows a well-established trust-building strategy. First, the threat actor publishes a clean version that delivers the advertised functionality. Then, after gaining a user base, a subsequent update injects malicious code. Consequently, users who installed a legitimate utility unknowingly received malware through the browser’s automatic extension update mechanism. Chrome extensions update at startup and periodically every few hours, meaning infections spread rapidly.

Five of the 19 extensions were purchased from legitimate developers, while the remaining 14 were created by the threat actor from the start. Therefore, the campaign blended both acquired trust and fresh distribution channels to maximize its reach.

Technical Details of the Malicious Extension Framework

All identified extensions share a common malware framework designed for extensibility and stealth. The background service worker establishes an encrypted WebSocket connection to a command-and-control server, downloads JavaScript modules, strips Content Security Policy headers from every visited website, and injects malicious scripts through hidden HTML elements.

Core Malware Capabilities

Socket observed 19 distinct malicious modules, each serving a specialized purpose within the framework. The malware capabilities include:

• Draining EVM, Solana, and Tron wallets by hijacking legitimate “Connect Wallet” and “Swap” buttons on decentralized finance platforms
• Replacing Ledger and Trezor hardware wallet websites with convincing seed-phrase phishing pages
• Stealing sessions, tokens, account data, and balances from Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, and MetaMask
• Recording credentials and form entries across all visited websites
• Harvesting Facebook and LinkedIn account information
• Exfiltrating complete browser history
• Displaying ClickFix-style fake browser update prompts that instruct victims to execute attacker-provided PowerShell commands

Extension Acquisition and Update Evasion

The “Enable Right Click & Copy — Smart Unlock + OCR” extension illustrates the campaign’s most dangerous vector. Initially developed by PreppHint, the extension had approximately 70,000 Chrome users when the threat actor acquired it. Combined with its Edge version and roughly 10,000 additional users, the single extension represented a potential infection surface of 80,000 users.

After Google identified the Chrome extension as malicious and removed it, the threat actor adapted. On August 14, 2026, a new Edge version was published with an updated command-and-control domain. Thus, the campaign demonstrates active maintenance and rapid infrastructure rotation.

Business and Operational Impact

The impact of this campaign extends far beyond individual cryptocurrency holders. Organizations face significant risk because browser extensions operate within the trusted browser context and can access corporate SaaS sessions, cloud consoles, and internal web applications.

• Cryptocurrency theft: Direct financial losses for individuals and organizations holding digital assets across multiple blockchain networks
• Credential exposure: Harvested passwords and session tokens enable follow-on attacks against corporate systems and personal accounts
• SaaS compromise: Stolen sessions from platforms like Coinbase, MetaMask, and social media accounts can lead to business email compromise and lateral movement
• ClickFix propagation: Infected users may be instructed to run malicious commands, potentially deploying additional malware on corporate endpoints
• Reputational damage: Organizations whose employees install browser extensions without review face increased supply-chain risk

Mitigation and Recommendations

Immediate Actions for Users

1. Review installed Chrome and Edge extensions against Socket’s published list of malicious extension IDs
2. Remove any matching extensions immediately and rotate all passwords for accounts accessed through the affected browser
3. Move cryptocurrency holdings to newly created wallets with fresh seed phrases
4. Enable multi-factor authentication on all accounts, especially cryptocurrency exchanges and financial platforms
5. Review browser history and financial account activity for unauthorized transactions or access

Immediate Actions for Defenders

1. Audit enterprise browser extension policies and restrict installations to approved extensions only
2. Monitor network traffic for WebSocket connections to known command-and-control domains published in Socket’s report
3. Scan endpoint logs for Content Security Policy stripping events and unusual script injection activity
4. Deploy browser security solutions that can detect and block extension-based script injection
5. Alert users to the specific extension names and IDs identified in this campaign

Long-Term Recommendations

Organizations should treat browser extensions as a legitimate software supply-chain risk. Therefore, implement a formal extension approval workflow, review extension permissions at installation, and regularly audit installed extensions across the fleet. Additionally, consider browser isolation for high-risk workflows involving cryptocurrency or financial transactions.

Bottom line: Browser extension stores remain a weak point in the software supply chain. Attackers are buying popular extensions and turning them into malware distribution platforms. Treat every extension as potential risk, review permissions carefully, and restrict installations to business-essential tools.

Incident Summary

CVE ID / Incident:	Socket Threat Research — Malicious Chrome and Edge Extension Campaign
Affected Systems:	Google Chrome and Microsoft Edge browsers with affected extensions installed
Disclosure Date:	August 27, 2026
Patch Status:	Chrome extensions removed from Web Store; Edge versions partially active as of August 30, 2026

References

1. Socket Threat Research, “19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads,” Socket.dev, August 27, 2026. https://socket.dev/blog/chrome-edge-extension-wallet-drainer (accessed August 30, 2026).
2. Bill Toulas, “Chrome Web Store extensions caught stealing crypto, browser data,” BleepingComputer, August 30, 2026. https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/ (accessed August 30, 2026).
3. DomainTools DTI, “Hidden Threats of Dual-Function Malware Found in Chrome Extensions,” DomainTools, February 2024. https://dti.domaintools.com/research/hidden-threats-of-dual-function-malware-found-in-chrome-extensions (accessed August 30, 2026).
4. Secure Annex, “Pixel Perfect: Chrome Extension Malware Analysis,” Secure Annex, 2024. https://annex.security/blog/pixel-perfect/ (accessed August 30, 2026).