Socket says five of the nineteen Chrome and Edge extensions in a wallet-draining campaign it published on August 27 were working tools bought from their original developers and then updated into malware — and the Edge listing was still serving when the report went out.
What happened
The peg here is three days old, so the dates matter. Socket published its analysis on Thursday, August 27, 2026. BleepingComputer brought it to wider attention on Sunday, August 30. Nothing about the campaign changed in between; what changed is how many people had seen it.
Socket’s report states that “Socket identified 18 Chrome extensions and 1 Edge extension” carrying the same malicious framework. The company tracks the activity as Superior, and explains the name plainly: “Socket is tracking this campaign under the name ‘Superior’ based on the tags observed in the names of the malicious JavaScript modules.” Socket says the operation has been running since early 2024.
Fourteen of the extensions were built by the operator and published to look like ordinary utilities — PixelCheck, Creative Library, SEO Pulse Pro, and Private Crypto News Reader among them. The other five were not. Socket describes them as “5 extensions bought from legitimate authors,” and the one it documents in detail is “Enable Right Click & Copy — Smart Unlock + OCR,” an extension originally written by an organization Socket names as PreppHint before, in Socket’s words, “being acquired by the threat actor.” Of the install base, Socket writes: “At the time when the malicious functionality was introduced, the extension had around 70,000 users.” The Edge build of the same extension, listed as “Allow Copy – Select & Enable Right Click,” carries around 10,000 users. The other acquired listings Socket names are “RapidLens – Google Lens for Screen Search & Images,” “QuickLens – Search Screen with Google Lens,” and “Password Protect PDF.”
The mechanism is worth reading closely, because it is built out of ordinary extension APIs rather than an exploit. A background service worker opens a persistent WebSocket connection to a command-and-control server and keeps it alive with a heartbeat every five minutes. It then, per Socket, “registers a dynamic declarativeNetRequest browser rule that strips Content-Security-Policy headers from every page.” With CSP removed, a content script creates “hidden DOM elements (<img>, <input>, <form>) in the websites that user visits,” attaches the downloaded payload as an event handler on one of those elements, fires it so the code runs in the page’s main world rather than the extension’s isolated world, and deletes the element immediately afterward.
That last detail is the design goal. Extension content scripts normally run in an isolated world and cannot touch a page’s own JavaScript objects — which is exactly what a wallet drainer needs to reach, because window.ethereum and its equivalents live in the page. Stripping CSP and bouncing the payload through a throwaway DOM node gets the code into the page context and leaves nothing behind in the DOM to find.
Socket counts sixteen observed modules and does not present that as an exhaustive list. They fall into roughly seven jobs: a multi-chain wallet drainer covering EVM chains, Solana, and Tron; seed-phrase phishing modules named Superior-trezor and Superior-ledger; account harvesters aimed at OKX, MEXC, Kraken, KuCoin, Coinbase, Binance, Bybit, and MetaMask; a general credential and form grabber called Superior-grabber; session theft aimed at Facebook and LinkedIn; browser history exfiltration via Superior-history; and Superior-updater, which serves ClickFix-style fake update lures. Socket lists roughly twenty primary command-and-control domains, among them active-enable-right-click[.]top and enable-right-click[.]click.
On store status, Socket wrote: “At the moment of writing, the Chrome extension was already identified as malicious and removed from the Chrome Web Store, but the Edge version of the extension is still active and serving malware. The finding has been reported to the Edge extension store.” Socket does not name an actor. It notes “similarities observed in techniques and operational methods that overlap with a previous threat research investigation conducted by DomainTools” from February 2024, and characterizes the operator as capable and long-running. That is an overlap observation, not an attribution, and it should not be read as one.
Why it matters
Extension review is built around the moment of publication. A developer submits a package, a reviewer or an automated system looks at what it does, and the listing goes live. Everything after that — the update channel — runs on the assumption that the developer on the account is the same party who passed review. Buying the account breaks that assumption without triggering anything, because nothing in the pipeline treats a change of ownership as an event worth re-reviewing. The extension keeps its ID, its reviews, its install base, and its granted permissions. The users who already trusted it are not asked again.
This is the same shape as the npm and PyPI maintainer takeovers that defenders have spent several years learning to watch for, and the browser stores are the version of it with the worst blast radius. A compromised npm package runs in a build. A compromised extension with host permissions runs in the session where the user is already authenticated to their bank, their exchange, their identity provider, and their employer’s SaaS. There is no second factor to defeat, because the code is executing inside an authenticated session that already cleared it.
The CSP stripping deserves separate attention from anyone who has been treating Content-Security-Policy as a control they own. A site’s CSP is delivered by the site, but it is enforced by the browser, and an extension with declarativeNetRequest permission can rewrite the response headers before enforcement happens. A bank can ship a perfect policy and have it removed on the client for any user with this extension installed. Server-side header audits will show the policy intact. They are measuring the wrong end of the pipe.
The store asymmetry is the operational lesson. The same code, from the same operator, was pulled from one store and left up in the other. Organizations that manage Chrome extensions through enterprise policy and treat Edge as the browser nobody uses have a gap that is not theoretical here — it is the specific listing Socket reported and, on Socket’s account as of August 27, the one still serving.
Finally, the scale claim should be read for what it is. Socket gives real numbers where it has them — roughly 70,000 Chrome users and 10,000 Edge users on the one extension it documents in depth — and does not publish a total across all nineteen. That is the honest version, and it is a smaller and more useful number than “millions of users at risk.” It is also single-vendor research. No second firm has published a corroborating analysis, and the store telemetry that would settle install totals belongs to Google and Microsoft.
What to do
Inventory installed extensions across both Chrome and Edge, including on machines where Edge is present but unmanaged. Compare against Socket’s published list of extension IDs rather than against extension names, which the operator controls and can change.
Remove the named extensions where found, and treat removal as insufficient on its own. Any browser profile that ran one should have its session cookies invalidated and its saved credentials rotated, starting with exchange accounts, financial accounts, Facebook, and LinkedIn — the specific targets the modules name. Anyone who was prompted for a Trezor or Ledger seed phrase in a browser should treat that wallet as compromised and move funds to a new seed.
Block the command-and-control domains Socket lists at the resolver, and search DNS and proxy logs back to early 2024 for them. Persistent outbound WebSocket connections from a browser process to a domain nobody can account for are worth a look on their own.
For the longer term, move Chrome and Edge extensions to an allowlist enforced by policy — ExtensionInstallAllowlist and ExtensionInstallBlocklist exist in both. An allowlist does not stop an approved extension from being sold and updated, but it caps the set of listings you have to watch. Watch that set for ownership and publisher changes; the stores surface the publisher name, and a change there is the signal this campaign generates.
Sourcing note
Checked against Socket’s own research post of August 27, 2026, which is the primary source for every number, module name, quotation, and indicator above. This is single-vendor research: Socket is the only firm to have published an analysis of this campaign, and no independent corroboration exists as of publication. Socket’s module count of sixteen is described as observed, not exhaustive, and Socket does not publish a combined install total across all nineteen extensions; the roughly 70,000 and 10,000 figures apply to one extension’s Chrome and Edge listings.
Socket’s statement that the Edge listing was “still active and serving malware” is dated to its August 27 publication. Severity Daily attempted to verify the Edge Add-ons listing directly and could not: the store renders its listing pages in the browser, and automated retrieval returns the page shell without the listing data. Current availability is therefore unconfirmed here, and readers should check the store themselves rather than rely on this page’s timestamp. Neither Google nor Microsoft has published a statement about the campaign, and neither has confirmed removal counts.
The DomainTools overlap Socket cites is a similarity in techniques and operational methods, not an attribution. No actor is named, by Socket or here. Reporting by BleepingComputer on August 30, 2026 brought the research to wider attention; it is cited as a lead only, and every fact above is taken from Socket’s report rather than from that coverage.
