- Messages
- 91
- Likes
- 10
- Points
- 8
Analysts from Socket discovered 18 malicious extensions for Google Chrome and one for Microsoft Edge. All extensions loaded a modular framework designed to steal victims' cryptocurrency, credentials, and browser history, and also displayed ClickFix lures to users.
The researchers dubbed this campaign "Superior" and believe it may have been active since February 2024.
The investigation revealed that the attackers purchased five of the 19 extensions from their previous developers, and created another 14 themselves. Moreover, the original versions of the extensions were often "clean" and performed all their stated functions; the malicious code appeared later, with one of the automatic updates, after the extensions had already gained a following.
[td]Malicious extension for Edge[/td]Experts cite the Enable Right Click & Copy — Smart Unlock + OCR extension as the most striking example of this tactic. When this extension became malicious, it already had over 70,000 users in Chrome and another 10,000 in Edge.
Once installed (or updated maliciously), these extensions established a persistent encrypted WebSocket connection to the command-and-control server and retrieved the necessary JavaScript modules from there. The command-and-control infrastructure and data exfiltration addresses could be dynamically changed at the attackers' command.
Furthermore, the malware removed Content Security Policy headers from all visited pages, allowing it to surreptitiously inject its own scripts into any website.
According to experts, some of these modules interfered with the Connect Wallet and Swap buttons on cryptocurrency websites and emptied wallets on the EVM, Solana, and Tron networks. Others replaced Ledger and Trezor websites with phishing pages aimed at stealing victims' seed phrases.
The malware also stole sessions, tokens, account data, and balances from Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, and MetaMask.
The malicious extensions also included a universal form and credential grabber, stealers for Facebook (owned by Meta, a company banned in Russia) and LinkedIn accounts, a browser history stealer, and a ClickFix decoy tool. The latter was used to create fake ClickFix-style notifications that informed victims to update their browsers. Victims were prompted to execute commands provided by the attackers. The researchers warn that the discovered set of modules may be incomplete, as the framework's architecture allowed the attackers to easily add new payloads. By the time Socket published its report, all discovered extensions had already been removed from the Chrome Web Store, but the Edge extension was still available in the Microsoft Store. Users who had malicious extensions installed (the full list can be found in the Socket report ) are now advised to consider their credentials compromised and change their passwords as soon as possible. Furthermore, experts advise those who stored cryptocurrency in affected wallets to transfer their assets to new addresses.
The researchers dubbed this campaign "Superior" and believe it may have been active since February 2024.
The investigation revealed that the attackers purchased five of the 19 extensions from their previous developers, and created another 14 themselves. Moreover, the original versions of the extensions were often "clean" and performed all their stated functions; the malicious code appeared later, with one of the automatic updates, after the extensions had already gained a following.
Once installed (or updated maliciously), these extensions established a persistent encrypted WebSocket connection to the command-and-control server and retrieved the necessary JavaScript modules from there. The command-and-control infrastructure and data exfiltration addresses could be dynamically changed at the attackers' command.
Furthermore, the malware removed Content Security Policy headers from all visited pages, allowing it to surreptitiously inject its own scripts into any website.
According to experts, some of these modules interfered with the Connect Wallet and Swap buttons on cryptocurrency websites and emptied wallets on the EVM, Solana, and Tron networks. Others replaced Ledger and Trezor websites with phishing pages aimed at stealing victims' seed phrases.
The malware also stole sessions, tokens, account data, and balances from Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, and MetaMask.
The malicious extensions also included a universal form and credential grabber, stealers for Facebook (owned by Meta, a company banned in Russia) and LinkedIn accounts, a browser history stealer, and a ClickFix decoy tool. The latter was used to create fake ClickFix-style notifications that informed victims to update their browsers. Victims were prompted to execute commands provided by the attackers. The researchers warn that the discovered set of modules may be incomplete, as the framework's architecture allowed the attackers to easily add new payloads. By the time Socket published its report, all discovered extensions had already been removed from the Chrome Web Store, but the Edge extension was still available in the Microsoft Store. Users who had malicious extensions installed (the full list can be found in the Socket report ) are now advised to consider their credentials compromised and change their passwords as soon as possible. Furthermore, experts advise those who stored cryptocurrency in affected wallets to transfer their assets to new addresses.