Chrome Web Store Extensions Caught Stealing Crypto, Browser Data

What Happened

Security researchers at Socket uncovered 19 malicious modules distributed across multiple browser extensions on the Chrome Web Store and Microsoft Edge Add-ons store. The extensions deliver a modular malware framework that drains cryptocurrency wallets, steals browser data, and injects ClickFix-style fake browser-update lures. The campaign appears to have been active since early 2024, and one compromised extension alone — "Enable Right Click & Copy — Smart Unlock + OCR" — reached roughly 70,000 Chrome users and 10,000 Edge users.

Incident Details

How the Malware Framework Works

The framework establishes an encrypted WebSocket connection back to attacker-controlled command-and-control servers, then downloads additional JavaScript modules on demand. Once active, it strips Content Security Policy (CSP) headers from visited pages and injects malicious scripts through hidden HTML elements — allowing it to manipulate page content without triggering the browser protections that would normally block such injection.

Cryptocurrency Theft

• Hijacking wallet interactions: The malware intercepts and hijacks legitimate "Connect Wallet" and "Swap" buttons on sites interacting with EVM-compatible chains, Solana, and Tron.
• Fake hardware-wallet pages: It replaces legitimate Ledger and Trezor sites with phishing pages designed to harvest seed phrases.
• Exchange session theft: It steals sessions and account data from major exchanges including Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, and Bybit, as well as from MetaMask.

Beyond Crypto

The framework also harvests general browser history and credentials across visited sites, along with Facebook and LinkedIn account data. It further deploys ClickFix-style fake browser-update prompts that trick victims into manually executing attacker-supplied commands — a technique increasingly common across unrelated malware families this year.

Impact Assessment

Recommendations

For Affected Users

• Remove any suspicious or unfamiliar extensions immediately, especially ones with broad host permissions.
• Change passwords for all accounts accessed from the affected browser, and assume credential compromise.
• Move cryptocurrency to a newly created wallet if you interacted with any wallet-connect prompts while a malicious extension was installed.
• Review connected-app permissions on exchange accounts (Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit) and revoke anything unrecognized.
• Enable hardware-wallet transaction verification, and never enter a seed phrase into a website — legitimate wallet software never asks for it that way.

For Organizations

• Restrict browser-extension installation to an approved allowlist via enterprise policy.
• Periodically audit installed extensions for permission scope creep following updates, since this campaign relied on malicious updates to previously legitimate extensions.
• Monitor outbound WebSocket connections from managed endpoints for unexpected destinations.

Key Takeaways

1. Socket identified 19 malicious modules across Chrome and Edge extensions running a shared malware framework.
2. The framework strips CSP protections and injects hidden scripts to hijack wallet-connect flows across EVM, Solana, and Tron.
3. Fake Ledger/Trezor pages and stolen exchange sessions extend the theft beyond browser-based wallets to major exchanges.
4. The campaign also harvests general browser credentials and deploys ClickFix-style fake update lures.
5. One compromised extension alone reached roughly 80,000 combined installs, and the campaign has reportedly run since early 2024.

Sources

• BleepingComputer — Chrome Web Store extensions caught stealing crypto, browser data