The Attack That Breaks Everyone’s Advice
Standard advice about browser extensions goes like this: download only from the official store, check the install count, read the reviews, look at the developer.
In late August 2026, Socket Threat Research published findings that invalidate every part of that checklist.
Researchers disclosed a cluster of 19 malicious extensions — 18 for Chrome, one for Microsoft Edge — carrying a shared wallet-stealing and crypto-draining framework. Socket researcher Karlo Zanki named the operation Superior, after strings found in its malicious JavaScript modules. Code and infrastructure similarities link the campaign back to at least February 2024.
Fourteen of the nineteen were built by the attackers. Five were acquired from legitimate developers.
That’s the part that matters. The acquired extensions had done exactly what they advertised, for years, with real users and genuine reviews. The malware arrived later, through automatic updates, with no action required from anyone who had them installed.
The most notable case: Enable Right Click & Copy — Smart Unlock + OCR, originally developed by PreppHint before being acquired. It had roughly 70,000 Chrome users when the malicious update landed, with a matching Edge version carrying about 10,000 more.
Zanki singled out Chrome’s default auto-update behaviour as the mechanism that let acquired extensions reach large install bases with a malicious update, without any user action at all.
Buying an established extension gives an attacker immediate access to a large, trusting user base. Automatic updates do the distribution. Neither the install count, the review history, nor the years of legitimate operation tell you anything about what the extension is doing today.
What the Malware Actually Did
This wasn’t a simple credential stealer. It was a modular platform.
The delivery architecture
Once installed — or once an existing install received the malicious update — the extension established a persistent encrypted WebSocket connection to a command-and-control server and pulled JavaScript modules from it on demand.
That design matters for two reasons. First, the extension package itself can look clean on inspection, because the payload lives on a remote server. Second, the operator can change capabilities at any time without shipping an update, so what the extension did last week tells you nothing about what it does now.
Before injecting its code, the framework strips Content Security Policy headers from websites using Chrome’s declarativeNetRequest API — removing the browser-level protection that would otherwise stop injected scripts from running on sensitive pages.
Read that again in terms of what it means: the extension disables the defence that would have blocked it, on the sites you care about most.
The sixteen modules
Socket catalogued 16 distinct modules in one compromised extension:
- Multi-chain wallet drainers targeting EVM, Solana and Tron wallets
- A hardware-wallet seed-phrase harvester that replaces Ledger and Trezor websites with convincing recovery pages designed to capture 12-, 18- or 24-word phrases
- Session and credential harvesters targeting Binance, Coinbase, Kraken, OKX, MEXC, KuCoin, Bybit and MetaMask
- A universal form and credential grabber
- Facebook and LinkedIn account stealers
- A browser history exfiltrator
- A ClickFix-style lure that displays a fake browser-update prompt instructing the victim to paste an attacker-supplied command
The seed-phrase module is the most dangerous thing in that list, and the most instructive. It replaces the real Ledger or Trezor site with a fake recovery page. You navigate to the correct URL. You see the correct domain in the address bar. The page is a forgery rendered by something already running in your browser.
Every piece of advice about verifying URLs — ours included — assumes the browser is faithfully rendering what the server sent. A malicious extension breaks that assumption at the root.
Socket also warned that the framework may contain further modules, and that new payloads are expected as the malware evolves.
The extensions involved
The crypto-themed extensions Socket named include:
- Private Crypto News Reader
- Crypto Rates & Fiat Converter
- Crypto Alerter: Price Alarms & Volatility Warnings
- Crypto Price Badge: Quick Glance
- LedgerLook: Wallet Checker
Note what these have in common. They are utilities a careful crypto user would plausibly install — a price badge, a rate converter, a wallet checker. Nothing about them signals risk. “LedgerLook: Wallet Checker” is, in a dark way, an excellent name: it sounds like a security tool.
Both Google and Microsoft removed the extensions from their stores. Which brings us to the worst detail in this entire story.
Removal From the Store Does Not Remove It From Your Browser
Users of affected extensions receive no notification that an extension has been removed from the store. The malware continues to run and continues to collect data.
Sit with the implication. An extension can be publicly identified as malware, be removed from the Chrome Web Store, be written up in security press — and still be quietly draining the wallets of everyone who installed it, because nobody tells them.
Store removal protects future installers. It does nothing for you.
This is why auditing your own installed extensions is not optional, and not something you can delegate to Google.
Firefox Is Not a Refuge
If your reaction is to switch browsers, Socket’s parallel research closes that exit too.
Researchers identified more than 70 linked Firefox extensions in a campaign dubbed the “Offside Wallet Theft Factory,” running since at least March 2026. Of 77 add-ons analysed, 40 were confirmed malicious — stealing crypto wallet seed phrases or credentials — while 37 were deceptive sports-score shells used to build an appearance of legitimate publishing activity.
One example: an extension called “0KX WEB3” mimicking the OKX exchange by substituting a zero for the letter O. It contained no wallet code at all — the entire extension existed to harvest recovery phrases.
Socket’s own assessment is blunt: even short-lived wallet extensions can cause immediate and irreversible harm once victims expose recovery phrases or private keys. A malicious extension doesn’t need to survive long. It needs to survive until you type your seed phrase into it.
Mozilla responded vigorously, but the researchers’ broader warning stands — browser extensions can become malware quickly, on any platform.
Historical Context: This Is Not New, It’s Matured
The earliest wave was crude. In 2020, Google removed 49 fake crypto wallet extensions after MyCrypto’s Harry Denley identified them impersonating Ledger, Trezor, Jaxx, Electrum, MyEtherWallet, MetaMask, Exodus and KeepKey — with Ledger the most-impersonated brand, roughly double the second-place MyEtherWallet. Most had positive reviews written in simplistic or broken English, and most shared identical structure and files.
Compare that to Superior: acquired legitimate extensions, remote modular payloads, CSP stripping, encrypted command-and-control, sixteen capability modules, and a two-year operational history before detection.
The 2020 fakes could be spotted by reading the reviews. The 2026 campaign cannot be spotted by any user-facing signal at all.
What You Should Actually Do
Right now, once: audit everything installed
Open your extensions page (chrome://extensions, edge://extensions, about:addons) and go through every single entry.
Remove anything you don’t actively use this month. Not anything suspicious — anything unused. You cannot assess which extensions are safe, so reduce the count instead. An extension you haven’t opened in six months is pure risk with zero benefit.
For the ones you keep, check the permissions (in Chrome: Settings → Extensions → Details) and confirm they’re in line with what the extension actually does. A price-badge extension requesting the ability to read and change data on all websites is disproportionate — though note that this check would not have caught Superior, since the acquired extensions legitimately needed broad permissions for their original function.
Ongoing: the three habits that work
1. Use a dedicated browser profile for crypto, with near-zero extensions. Your wallet, and nothing else. No price trackers, no converters, no productivity tools, no ad blockers. Do your general browsing in a separate profile. This is the highest-leverage change available and it takes ten minutes to set up.
2. Never enter a seed phrase into a browser tab. Ever. Legitimate Ledger and Trezor recovery flows do not work that way — recovery happens on the device itself. There is no circumstance in which a real hardware wallet recovery asks you to type your phrase into a web page. If you are looking at such a page, it is a forgery, regardless of what the address bar says.
3. Hold long-term assets on hardware, with the device screen as the final check. A malicious extension can rewrite a page, forge a site, and manipulate what your browser displays. It cannot change what appears on a hardware wallet’s own screen. That screen is the one surface in the chain an in-browser attacker cannot touch — which is precisely why reading it matters.
If You Had One of These Installed
If you entered a seed phrase: treat that wallet as permanently exposed. Create a new wallet on a clean device and transfer remaining assets; never reuse the old seed. A stolen seed phrase cannot be made safe by changing a password, and no amount of cleanup reverses it.
If you logged into exchanges in that browser: consider your credentials compromised and change passwords immediately, from a different device. The session-harvesting modules specifically targeted major exchange logins. Rotate 2FA where your exchange supports it.
If you connected a wallet or signed transactions: revoke all approvals, including both Permit2 layers, and move remaining assets. Related: How Wallet Drainers Work in 2026: Full Technical Breakdown
Handle wallet exposure separately from credential exposure. They require different responses and the seed phrase problem is the one that doesn’t have a fix.
Then uninstall the extension — but understand that uninstalling comes last, not first. It stops further collection; it doesn’t undo what’s already gone.
The Takeaway
An extension’s reputation describes its past. Its ownership, its code, and its remote payload can all change tomorrow, silently, through a mechanism designed for your convenience.
Monitoring for ownership changes is the defence researchers recommend — and realistically, almost nobody will do that. Which means the practical defence is the blunt one: install fewer extensions, keep crypto in a profile that has almost none, and let the hardware wallet screen be the thing you trust.
About the Author
N. Singh is the Founder and Editor-in-Chief of TrueToCrypto.com, with over a decade in blockchain and fintech, focusing on cryptocurrency security and threat analysis.
Transparency: N. Singh holds cryptocurrency and uses Ledger and Trezor hardware wallets. TrueToCrypto may earn affiliate commissions from links in articles. Recommendations are based on security merit, not commission rates. This article is educational and is not financial or security consulting advice.
Contact: info@truetocrypto.com
Findings in this article are drawn from Socket Threat Research disclosures of August and September 2026, as reported by BleepingComputer, CyberInsider and others. Extensions named were removed from their respective stores at time of publication; removal does not uninstall them from affected browsers.
