Security researchers at Socket have uncovered 19 browser extensions for Google Chrome and Microsoft Edge that secretly steal cryptocurrency wallet secrets and drain funds. The extensions — 18 for Chrome and one for Edge — are tracked under the name “Superior” and have been active since at least February 2024. What makes this campaign particularly difficult to detect is how the attackers get their malicious code in front of users: five of the extensions were purchased from their original, legitimate developers. Once acquired, the new owners published updates laced with wallet-stealing code, taking advantage of Chrome’s default setting to auto-update extensions to the latest version.
The remaining 14 extensions were created by the threat actors themselves, typically published as clean tools first to build a user base before the malicious update was pushed. The extensions span a range of categories — cryptocurrency price trackers, DeFi dashboards, SEO analyzers, and PDF tools — meaning the campaign is not limited to users who actively seek out crypto-related add-ons. Socket researcher Karlo Zanki noted that extension acquisition is an especially powerful attack vector because it lets threat actors inherit an established extension’s existing users without those users ever knowing ownership changed. Any extension on a user’s browser can be silently updated to a malicious version without prompting the user for re-approval.
How to check if you’re affected
Affected products are any Chrome or Edge browser installations running one of the 19 identified extensions. Extension IDs to check include: koccklolohdacbfooifnpebakpbeipc (Enable Right Click & Copy), fegckejpfnlmfgkfjpinlbgmeeijjkel (RapidLens), kdenlnncndfnhkognokgfpabgkgehodd (QuickLens), jamminefolhgepgihbmcjjhgldbfcikp (Password Protect PDF), inmkjedjdhgpknjogbjomhnbgdccckkg (Allow Copy — Edge), fcgdejjichpgfaaafflplhfijcnieopb (PixelCheck), cfpnjdbpojpcongfaefcamjbaolpelcd (Creative Library), and twelve others. Affected versions include any version that received a malicious update. Open chrome://extensions or edge://extensions, search for these IDs, and remove any you find. If you have a crypto wallet extension installed and noticed unexpected transactions, consider revoking wallet approvals and rotating wallet keys.