The publishing pattern is the same across all 19: version one does the advertised job and carries no malware, then a later release, once base trust exists, introduces the malicious behavior [5]. Building that trust yourself is slow. Buying it is a transaction, and Socket names acquisition of established extensions offered for sale with an existing user base as the most impactful tactic in this campaign [4]. The covers are unglamorous utilities: SEO stats checkers, crypto price monitors, screen search tools, ad spying tools [7]. Things people install once and never open again.
Delivery is a documented default. Chrome's extension update settings auto-update to the latest version at startup and then periodically every few hours [11]. So the gap between publishing a weaponized version and having it resident on the installed base is hours, not a review cycle [20], and nobody re-approves anything unless the manifest asks for wider permissions.
Socket puts the combined Chrome and Edge surface for the acquired OCR extension at 80,000 users [12], and is careful to say that does not mean every one of them ran the malicious build [10]. For that number to transfer as exposure, each of those installs would have to sit on an active profile that fetched an update between the malicious publish and the takedown. Read it as the blast radius the buyer acquired, not a victim count.
What arrives is thin by design. The background service worker keeps its state in chrome.storage.local: a user identifier, install and last-active timestamps, an inactivity limit, and a list of downloaded code modules it calls nodes [16]. Samples open a WebSocket channel to the C2 server, strip CSP, and abuse XSS injection to execute code fetched earlier [2]. Socket reads the pluggable structure as a sign the final payload changes over time while the goal stays wallet secrets and crypto draining [17], which means a clean read of whichever version is live tells you about that version and nothing else. The same state object also tracks welcome-shown and analytics-consent [16], the most legitimate-looking lines in the file.
The recovery move is instructive. The Edge build is about one eighth of that 80,000 surface [19], and it is the part still shipping: after Chrome acted, a new Edge version went out on 14 August 2026 pointing at a fresh C2 domain [14]. The publisher pipeline that carried the weaponization carries maintenance just as well.
In my context, the control that matters here is not store review, which already ran and passed. It is update policy: pinning versions, or at least alerting on updates to extensions whose ownership can change without any signal a user or an admin would see. The decision you made at install was about a different codebase.
