Superior campaign: wallet-draining malware in browser extensions

Researchers at Socket identified a cluster of 19 malicious extensions — 18 for Google Chrome and one for Microsoft Edge — which, according to available data, contain functionality for stealing secrets from cryptocurrency wallets and draining funds. The most widely distributed extension, “Enable Right Click & Copy — Smart Unlock + OCR,” is installed on approximately 80,000 users’ systems. The campaign, tracked under the name Superior, is believed to have been active since February 2024 and uses the browser extensions’ automatic update mechanism to deliver malicious code to users who previously installed a legitimate version.

Attack mechanism: trust through legitimacy

The campaign’s key tactic is abusing users’ trust in already-installed extensions. According to Socket, of the 19 identified extensions, 5 were acquired from previous owners, and 14 were created and published by the attacker. In both cases, the initial version of the extension performs its stated functions without any malicious activity. Once a user base has been accumulated, an update containing malicious code is released.

This approach is particularly dangerous due to an architectural characteristic of the Chrome Web Store: according to the Google Chrome Web Store Terms of Service, extension updates can be automatically downloaded and installed without additional user notification. As a result, a user who installed a safe version will receive a malicious update without any interaction. This technique corresponds to MITRE ATT&CK T1176.001 (Browser Extensions), where extensions are used to maintain persistence, intercept data, and provide a command channel.

Technical capabilities of the malicious code

According to the research, the malicious code is embedded into the extensions and performs the following actions:

• Removes Content Security Policy (CSP) headers from all visited pages
• Injects JavaScript modules into target sites via the content scripts mechanism
• Establishes a persistent WebSocket connection to a command-and-control (C2) server

Socket reports the discovery of 16 malicious modules, divided into the following categories:

• Multi-chain wallet-draining module (wallet drainer)
• Collector of hardware wallet seed phrases
• Collector of cryptocurrency exchange and wallet credentials
• Generic credential and form interceptor
• Modules for stealing Facebook and LinkedIn accounts
• Browser history theft module
• ClickFix module — simulates a browser update with instructions to copy and paste a malicious command

The command infrastructure deserves particular attention. According to Socket researcher Carlo Zankí, the loader framework supports rotation of C2 server addresses based on instructions received from the primary command server. The data exfiltration endpoint is also assigned dynamically, which potentially allows the creation of individualized data exfiltration channels for each victim. It should be noted that these claims are based on a single source and are not supported by publicly available code samples, traffic captures, or domain names.

Campaign context

Previously, the “QuickLens — Search Screen with Google Lens” extension was independently flagged by Annex Security and monxresearch-sec researchers as capable of delivering malware, injecting arbitrary code, and collecting sensitive data. In May 2025, DomainTools documented related activity that included creating fake websites mimicking legitimate services — productivity tools, VPN services, cryptocurrency and banking utilities — to entice users into installing malicious extensions.

The identity of the campaign operator remains unknown. The name “Superior” is a label used by Socket for research purposes, not an attribution to any known threat group. The original material states that the campaign has been active for “more than two years,” while also indicating a presumed start date of February 2024 — these timelines are inconsistent, which calls for caution when assessing the operation’s duration.

Impact assessment

The primary risk group consists of cryptocurrency holders who use browser-based wallets and hardware wallets with web interfaces. However, the presence of modules for stealing Facebook and LinkedIn credentials and a generic form interceptor expands the pool of potential victims to any user who has installed one of the 19 extensions. Automatic updating means that even users who installed an extension while it was still legitimate may have received a malicious version without their knowledge.

Protection recommendations

1. Immediately review installed extensions in Chrome (chrome://extensions) and Edge (edge://extensions) for any of the 19 IDs listed in the Socket report. If found, remove the extension and change passwords for all accounts used in that browser.
2. For cryptocurrency users: if any of the listed extensions were installed, treat as compromised all seed phrases and private keys that the browser could access. Transfer funds to new wallets generated on a known-clean device.
3. Restrict automatic extension updates in corporate environments via Chrome Group Policies (ExtensionSettings) — this allows you to control versions and review updates before deployment.
4. Minimize the number of installed extensions and regularly audit their permissions. Extensions with access to “all sites” pose the highest risk.
5. For organizations: implement allowlists of approved extensions and monitoring of WebSocket connections initiated by browser extensions.

The Superior campaign demonstrates a systemic weakness in the browser extension ecosystem: an automatic update mechanism designed for convenience becomes a vector for delivering malicious code. The top-priority action is to review all installed extensions against the list of 19 IDs and, if any match is found, perform full rotation of all credentials and cryptographic keys accessible from the compromised browser.