In short: Socket security researchers uncovered 19 Chrome and Edge browser extensions secretly draining cryptocurrency wallets, harvesting exchange session tokens, and stealing passwords — for more than two years. The "Superior" campaign put 80,000 users at peak exposure, targeting Binance, Coinbase, Kraken, OKX, and MetaMask accounts.
What Happened
On August 28, 2026, Socket researcher Karlo Zanki published a detailed report exposing the Superior campaign: 19 extensions for Google Chrome and Microsoft Edge had been quietly collecting users' sensitive data straight from the browser. Google swiftly removed the malicious extensions from the Chrome Web Store, but the Edge version remained available in the Microsoft store at the time of disclosure.
Five of the 19 extensions had been legitimate tools with genuine user bases before being weaponised. The most impactful, "Enable Right Click & Copy — Smart Unlock + OCR", had approximately 70,000 Chrome users and 10,000 Edge installs. The extension unlocked text selection on sites that disabled it — a useful feature that built a large, trusting audience. Once installed widely enough, the new owner pushed a malicious update.
How the Superior Attack Works
The threat actors use two strategies. First: acquiring established legitimate extensions from their original developers (typically for under $2,000) and silently publishing a malicious update. Second: publishing new extensions with genuine functionality, building an audience, then inserting malicious code in a later version.
At the technical level, the campaign operates as follows:
- After installation, the extension opens a WebSocket connection to a command-and-control (C2) server every five minutes.
- It strips Content Security Policy headers from every website the user visits, enabling arbitrary JavaScript injection.
- Stolen data is encrypted (AES-GCM with a SHA-256-derived key) and exfiltrated through Cloudflare Workers to 20 C2 domains registered in
.topand.prozones. - DomainTools independently confirmed code similarity across extensions, allowing full attribution to a single threat actor.
What Data Was Stolen
The malicious code contained 16 data-collection modules. At risk were:
- Crypto wallets: Trezor and Ledger hardware wallet seed phrases, EVM-chain (Ethereum-compatible), Solana, and Tron private keys.
- Exchange accounts: session tokens and cookies for Binance, Coinbase, Kraken, OKX, MEXC, KuCoin, and Bybit — enough for unauthorised login.
- DeFi wallets: connected MetaMask and other Web3 browser wallets.
- Browser data: autofill passwords, full browsing history, Facebook access tokens, LinkedIn profile data.
Seed phrase theft is especially severe: the recovery phrase is a master key to the entire wallet. An attacker who obtains it can drain all funds instantly, bypassing any exchange 2FA or withdrawal limits. There is no recovery after seed phrase compromise.
Full List of Superior Extensions
Five extensions acquired from legitimate previous owners (highest user reach):
- Enable Right Click & Copy — Smart Unlock + OCR (80,000 combined users)
- RapidLens — Google Lens for Screen Search & Images
- QuickLens — Search Screen with Google Lens
- Password Protect PDF
- Allow Copy — Select & Enable Right Click (Edge)
Extensions created from scratch by the threat actor (14): PixelCheck, Creative Library — Ad Spy Tool, Website Traffic Checker: MirrorSphere SEO Stats, Site Signal, SEO Pulse Pro, Private Crypto News Reader, Blockfolio: Address Monitor, Crypto Rates & Fiat Converter, Crypto Alerter, DeFi Pulse Tracker, Crypto Price Badge, Multi-Chain Explorer, LedgerLook: Wallet Checker, FeedX-Ray.
How to Protect Yourself
Socket and BleepingComputer researchers recommend these concrete steps:
- Audit your extensions now. In Chrome, open
chrome://extensions; in Edge,edge://extensions. Remove anything you haven't used in the past 30 days, and scrutinise any extension you don't clearly remember installing. - Rotate passwords and revoke active sessions on Binance, Coinbase, OKX and any other exchange if you had any of the listed extensions installed.
- Move seed phrases offline. A hardware wallet or encrypted USB drive disconnected from your browser is the safest option — no extension can reach data that isn't in the browser environment.
- Enable authenticator-app 2FA (not SMS) on all financial services: even if a session token is stolen, 2FA blocks login from a new device.
- Review permissions before installing any extension. An extension that requests "read and modify data on all websites" has the access needed to execute exactly this type of attack.
Network-level encryption via a VPN does not directly block a malicious extension, but it closes complementary attack vectors: unencrypted HTTP request interception and data exfiltration over public networks. For more on browser privacy, visit our security blog.