BuildNot yet confirmed elsewhere1 publisher3 min readPublished
Chrome's auto-update default distributed the drainer once the extension changed hands
Socket says the sharpest move in this campaign was buying utilities that already had users, then shipping the payload as version two. Install-time review had already run and passed, and the 80,000-user surface came with the purchase.
The Engineer · Build desk
What happened
- Socket identified 19 malicious extensions, 18 for Chrome and one for Edge, all published within the last six months and sharing one extendable malware framework aimed largely at wallet secrets.
- Fourteen of the extensions were created by the threat actor; the other five were bought from legitimate authors who had already built the user base.
- The highest-impact case, an OCR and right-click unlock tool originally built by PreppHint, had around 70,000 users at the moment the malicious functionality was introduced.
- Chrome has removed the malicious build, while the Edge version was still active and serving malware when Socket published, and has been reported to the Edge extension store.
- Code and technique overlaps tie the set to a campaign DomainTools first reported in February 2024, malware that Secure Annex has also documented.
Why it matters
- constraint Store review gates the code submitted, and the trust attached to an extension survives a change of owner, so the review that clears an extension happens before the code that matters is written.
- exposure Users and admins who vetted and approved the clean version got the payload with no prompt and no diff, because approving an extension also approves a publisher who is free to sell it.
- capability A loader that fetches swappable code modules means any audit or vendor scan certifies a snapshot, not the extension, so a clean result ages out with the next C2 push.
- precedent Publishing the same code to two stores means one takedown leaves the other operating, and moving infrastructure afterwards costs the actor a single release.
The publishing pattern is the same across all 19: version one does the advertised job and carries no malware, then a later release, once base trust exists, introduces the malicious behavior [5]. Building that trust yourself is slow. Buying it is a transaction, and Socket names acquisition of established extensions offered for sale with an existing user base as the most impactful tactic in this campaign [4]. The covers are unglamorous utilities: SEO stats checkers, crypto price monitors, screen search tools, ad spying tools [7]. Things people install once and never open again.
Delivery is a documented default. Chrome's extension update settings auto-update to the latest version at startup and then periodically every few hours [11]. So the gap between publishing a weaponized version and having it resident on the installed base is hours, not a review cycle [17], and nobody re-approves anything unless the manifest asks for wider permissions.
Socket puts the combined Chrome and Edge surface for the acquired OCR extension at 80,000 users [12], and is careful to say that does not mean every one of them ran the malicious build [10]. For that number to transfer as exposure, each of those installs would have to sit on an active profile that fetched an update between the malicious publish and the takedown. Read it as the blast radius the buyer acquired, not a victim count.
What arrives is thin by design. The background service worker keeps its state in chrome.storage.local: a user identifier, install and last-active timestamps, an inactivity limit, and a list of downloaded code modules it calls nodes [16]. Samples open a WebSocket channel to the C2 server, strip CSP, and abuse XSS injection to execute code fetched earlier [2]. Socket reads the pluggable structure as a sign the final payload changes over time while the goal stays wallet secrets and crypto draining [19], which means a clean read of whichever version is live tells you about that version and nothing else. The same state object also tracks welcome-shown and analytics-consent [16], the most legitimate-looking lines in the file.
The recovery move is instructive. The Edge build is about one eighth of that 80,000 surface [18], and it is the part still shipping: after Chrome acted, a new Edge version went out on 14 August 2026 pointing at a fresh C2 domain [14]. The publisher pipeline that carried the weaponization carries maintenance just as well.
In my context, the control that matters here is not store review, which already ran and passed. It is update policy: pinning versions, or at least alerting on updates to extensions whose ownership can change without any signal a user or an admin would see. The decision you made at install was about a different codebase.
What to watch
- Whether Microsoft pulls the Edge build, and how wide the gap between the two stores' takedowns ends up being.
- Whether either store starts surfacing a change of publisher to users who already have an extension installed.
- Whether Socket or Secure Annex publishes install counts for the other 18, which would show how much of the campaign's reach was bought rather than built.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption54
- Hype gap+14
- Incentives71
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Socket identified 19 malicious extensions, 18 for Chrome and one for Edge, published in the last six months and delivering an extendable malware framework.
- [2]
Identified malware samples create a WebSocket communication channel with a command and control server, perform CSP stripping, and abuse XSS injection to trigger execution of malicious payloads previously downloaded from the C2 server.
- [3]
Malicious capabilities are primarily focused on wallet secret stealing and crypto draining.
- [4]
Socket says the most impactful tactic in the campaign is acquisition of established extensions offered for sale with an existing user base, which then get weaponized with malicious functionality.
- [5]
All of the identified extensions used the same publishing approach: the first version implements the advertised functionality and is clean of malware, and a new version introducing malicious behavior is published later, once base trust is established.
- [6]
The identified extensions separate into 14 created by the threat actor and 5 bought from legitimate authors.
- [7]
The extensions implement utility tools including SEO stats checkers, crypto price monitors, screen search utilities and ad spying tools.
- [8]
The extension "Enable Right Click & Copy - Smart Unlock + OCR" was initially developed by a legitimate organisation, PreppHint, before being acquired by the threat actor.
- [9]
At the time the malicious functionality was introduced, that extension had around 70,000 users.
- [10]
Socket notes that the user count does not necessarily mean all of those users had the malicious version installed.
- [11]
Chrome extension update settings default to auto-updating to the latest version of the extension at startup and periodically every few hours.
- [12]
The Edge version of the same extension contains the same malware and has around 10,000 users, giving the extension a potential impact surface of 80,000 users.
- [13]
At the time of writing the Chrome extension had been identified as malicious and removed from the Chrome Web Store, while the Edge version was still active and serving malware; the finding was reported to the Edge extension store.
- [14]
Both the Chrome and Edge versions initially used the same C2 domain, and after the Chrome extension was identified as malware a new version of the Edge extension was published with an updated C2 domain on August 14th, 2026.
- [15]
Code and technique similarities connect the extensions to a campaign initially reported by DomainTools dating back to February 2024, and malware from the campaign has also been described in research by Secure Annex.
- [16]
The background service worker stores C2 and job orchestration state in Chrome extension local storage via chrome.storage, including a userId, an installed value, lastActive, an activityTimeout inactivity limit, downloaded code modules called nodes, plus welcome-shown and analytics-consent keys.
- [17]
Because auto-update is the default and the malicious code ships as an update to an already trusted extension, the interval between publishing a weaponized version and running on existing installs is hours rather than a store review cycle.
- [18]
The still-active Edge build accounts for about one eighth of the extension's stated 80,000-user impact surface.
- [19]
Socket says the pluggable design indicates the final payload is highly modifiable and likely changes over time, while the ultimate targets most likely remain wallet secret stealing and crypto draining.
Sources
1 independent publisher whose own reporting we read for this story.
- socket.dev19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads
1 article · August 27, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
Entities
- SocketFollow
- Karlo ZankiFollow
- Chrome Web StoreFollow
- Edge extension storeFollow
- Google ChromeFollow
- Microsoft EdgeFollow
- Enable Right Click & Copy - Smart Unlock + OCRFollow
- PreppHintFollow
- DomainToolsFollow
- Secure AnnexFollow
- chrome.storageFollow
- WebSocketFollow
- Content Security PolicyFollow