19 Chrome and Edge Extensions Drained Crypto Wallets

An extension that restores the right click menu on a page that disabled it is about as low stakes as browser software gets. Roughly 80,000 people across Chrome and Edge installed one called "Enable Right Click & Copy — Smart Unlock + OCR", and for a long stretch it did exactly that and nothing else. Then it changed hands. On August 27, 2026, Socket published research on 19 Chrome and Edge extensions sharing one modular malware framework built to empty crypto wallets. Five of them began life as legitimate tools somebody bought.

Key Takeaways

• Socket identified 19 malicious extensions, 18 on the Chrome Web Store and one on Microsoft Edge, running a shared malware framework it tracks as "Superior".
• Fourteen of the extensions were built by the threat actor; the other five were acquired from their original developers and weaponized through an automatic update.
• "Enable Right Click & Copy — Smart Unlock + OCR" reached roughly 70,000 Chrome users and 10,000 Edge users before Google pulled the Chrome listing.
• The framework targeted Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit and MetaMask sessions, plus Ledger and Trezor seed phrases, Facebook and LinkedIn accounts, and full browser history.
• Socket dates the campaign infrastructure to February 2024, with the malicious extension versions published in the six months before disclosure.

What Did Socket Actually Find?

One codebase wearing 19 faces. Socket matched the same modular loader across 18 Chrome listings and one Edge listing, wired to more than 20 command and control domains named to resemble the extensions they served, such as ggle-analytics[.]com. Stolen data left through Cloudflare Workers, putting exfiltration behind an IP range no corporate network is going to block.

Fourteen listings were the actor's own and skewed crypto themed: Private Crypto News Reader, DeFi Pulse Tracker, SEO Pulse Pro, PixelCheck. The other five were purchases, including the right click unlocker, the Google Lens helpers RapidLens and QuickLens, and Password Protect PDF. The Hacker News reported that QuickLens had already been flagged for code injection by other researchers before Socket's work landed.

This is the third extension supply chain story to cross our desk this month, after 77 evil twin extensions on Open VSX harvesting developer credentials on August 5 and 737 fake VPN extensions turning browsers into proxy exit nodes on August 13. Three campaigns, three marketplaces, one shared assumption: the review at publication is the only review that ever happens.

How Did Clean Extensions Turn Malicious?

Their owners sold them, and Chrome installed the new owner's code without telling anyone. Socket researcher Karlo Zanki put it plainly: "Chrome's default extension update settings, performs auto-updating to the latest version of extension, providing the threat actor with a powerful vector."

Nothing here is a bug. Google documents publisher ownership transfer as a supported workflow, because it has to be: developers change jobs and side projects get handed off. Silent updates are equally deliberate, and they are why a security patch reaches everyone in hours instead of never. Both mechanisms are load bearing. Together they produce a state nobody designed, where the extension you audited and the extension currently reading your screen are different programs under different management.

Which reframes the signals people use to pick extensions. A four star rating and 70,000 installs measure a codebase at a moment in the past, and they do not follow the code forward. The buyer earned none of it. There is no notification, no changed badge, no fresh permission prompt when a listing changes owner. The reputation transfers with the URL.

What Does the Malware Do Once It Loads?

It picks a module based on what site you are looking at. BleepingComputer's write up and Socket's own teardown describe roughly seven capabilities sharing one loader:

• A multi chain wallet drainer for EVM, Solana and Tron that hijacks the confirm button, so the transaction you approve is not the one you composed.
• Hardware wallet phishing injecting fake Ledger and Trezor recovery prompts. A seed phrase typed into a convincing overlay defeats the whole point of keeping keys off the computer.
• Exchange account harvesters for Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit and MetaMask, lifting sessions and tokens rather than passwords.
• A universal form grabber reading anything typed into any page, plus modules for Facebook and LinkedIn account data and wholesale browser history theft.
• ClickFix lures that render a fake browser update page and copy an attacker supplied command to your clipboard, with instructions matched to your operating system.

The plumbing deserves its own look. These extensions stripped Content Security Policy headers so injected scripts would run on sites that had explicitly forbidden third party code, hid payloads in DOM elements the page never renders, and held a WebSocket open with a five minute heartbeat. That last detail outranks the module list. An operator who can push fresh instructions to an already compromised browser makes the capabilities catalogued at disclosure a snapshot, not a ceiling.

What This Means for Your Inbox

Gmail is a web page, and an extension with permission to read web pages reads it exactly the way it reads Coinbase. Socket's modules aim at exchanges because crypto converts to money in one hop with no chargeback, not because a wallet interface is harder to reach than an inbox. Nothing in the framework's architecture would need to change to read mail.google.com. It is a targeting decision, revisable at any moment over a WebSocket that stayed open.

Follow that out. A content script that can strip CSP and inject a fake Ledger prompt can inject a fake session expiry prompt into Gmail, read the message you have open, or copy your contact list. The universal form grabber already captures anything typed into any page, including a mail password on a login screen. And the same content script model underpins extensions across Chrome, Edge and every Chromium fork, so this is not a Chrome problem to wait out.

So rank what you have by permission, not by publisher. "Read and change all your data on all websites" is functionally a person sitting behind you, watching your screen and typing when they feel like it.

How Do You Audit What You Already Installed?

Open chrome://extensions and work through the list once. Ten minutes, and it is the only part of this you control.

• Read the permissions, not the description. Click Details and check site access. Anything set to "On all sites" needs a reason you can say out loud. Google's permissions reference spells out what each warning grants.
• Downgrade what you keep. Switch site access to "On specific sites" or "On click". A screenshot tool does not need standing access to your bank.
• Delete anything you have not deliberately used in a month. Dormant extensions still run their content scripts and still receive automatic updates.
• Check the listing for a handover. Look at the developer name, the support email domain and recent reviews. A run of "this used to work, now it does weird things" under a five year old extension is the clearest public signal there is.
• Prefer a visible maintainer and an open codebase, the filter we applied when reviewing anti tracking extensions. It does not make an acquisition impossible. It makes one loud.

If you had any of the 19 installed, treat the browser as having been read. Change every password you used in it, and move any crypto to a wallet generated on a device that never ran the extension. A seed phrase that touched a compromised browser is not rehabilitated by uninstalling the thing that saw it.