Reported by 3 outlets

Timeline

1. original reporting

   Malicious Chrome and Edge Extensions Hijack Crypto Wallets and Steal Login Credentials

   cyberpress.org · 43d ago · August 31st, 2026

   Researchers identified 18 malicious Google Chrome extensions and one Microsoft Edge extension that share similar code, infrastructure, and operational techniques. Socket is tracking the activity as the Superior campaign, which appears connected to malware activity first reported by DomainTools in February 2024 and later analyzed by Secure Annex. The campaign abuses trust in legitimate-looking browser tools. The affected extensions advertised features such as SEO statistics , crypto-price monitoring, screen-search tools, ad spying, and copy-unlocking utilities. Their first published versions were clean and performed their claimed functions. After building a user base, attackers released updates that silently added malicious code. Socket said 14 extensions were created by the threat actors, while five were reportedly acquired from legitimate developers. Rogue Extensions Steal Wallets The extension with the largest potential impact was “Enable Right Click & Copy Smart Unlock + OCR.” It was originally developed by PreppHint before being acquired by the attackers. When malicious behavior was introduced, the Chrome extension had roughly 70,000 users. Its Edge counterpart had about 10,000 users, creating a possible exposure surface of 80,000 installations. This does not mean every user received the malicious version, but browser extensions normally update automatically, allowing attackers to rapidly distribute harmful updates. Malicious browser extensions (Source: socket) Google rem

2. update from bleepingcomputer.com

   Chrome Web Store extensions caught stealing crypto, browser data

   bleepingcomputer.com · 44d ago · August 30th, 2026

   Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, and to inject ClickFix lures. Researchers say all 16 malicious modules uncovered in the campaign serve distinct purposes and are designed to be "highly extensible." The operation was uncovered by application security company Socket, and the investigation indicates that it may have been active since early 2024. Socket says that when initially published on the Chrome Web Store, many of the extensions provided the advertised functionality and contained no malware. The number of installs on Edge was 10,000 at the time. Google caught the threat early and removed the extension from its add-ons marketplace, but at the time of Socket publishing its report, the Edge version remained available. Malicious extensions available on the Edge add-ons store Source: Socket Once installed, the malware establishes an encrypted WebSocket connection with command-and-control (C2) servers, downloads JavaScript modules, removes Content Security Policy (CSP) heade

3. update from gbhackers.com

   Chrome and Edge Extensions Strip CSP and Inject JavaScript to Drain EVM, Solana and Tron Wallets

   gbhackers.com · 43d ago · August 31st, 2026

   Research identified 19 malicious browser extensions 18 for Google Chrome and 1 for Microsoft Edge that use a modular malware framework to strip website Content Security Policy protections, inject attacker-controlled JavaScript. The most consequential […] The post Chrome and Edge Extensions Strip CSP and Inject JavaScript to Drain EVM, Solana and Tron Wallets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .