Socket researcher Karlo Zanki has identified 19 malicious browser extensions — 18 on Chrome, one on Edge — running what may be the same campaign since February 2024.

The largest, a right-click-unlocking utility, has around 80,000 users.

The acquisition detail

14 of the extensions were created by the operators. The other 5 were purchased from their previous owners.

Buying is the efficient half of the model. Building an extension and growing it to 80,000 users takes years of work that has nothing to do with crime, and buying one that already has them takes an email and a payment. Every existing user comes with it — along with the permissions they granted, the reviews they trusted, and the install base that makes the listing look safe to the next person.

There is no mechanism in any extension store that tells a user their extension changed hands.

Then the update ships

The pattern is two-phase: publish something clean, or buy something clean, and push the malicious version later.

Socket's point about why this works is the important one — Chrome's default extension settings enable auto-updates, which gives the operator a powerful vector to maximise impact.

The user's security decision happened at install time. They read the description, checked the reviews, considered the permissions, and decided. The code that decision applied to was then replaced, automatically, by design, without anything being shown to them.

Auto-update is a genuinely good default. It is how security patches reach people who would never apply them. It is also, here, the delivery mechanism.

What the extensions do

Sixteen distinct code modules, covering:

  • Multi-chain wallet draining
  • Hardware wallet seed-phrase harvesting
  • Cryptocurrency exchange account theft
  • Universal credential and form grabbing
  • Social account theft, specifically Facebook and LinkedIn
  • Browser history theft
  • ClickFix-style operating-system lures

The seed-phrase item deserves attention. The entire premise of a hardware wallet is that the recovery phrase never exists on the computer. It does exist there for a few seconds during setup or recovery, and that is what this targets — the one moment the design assumes is safe.

The last item connects this to the TerminalFix campaign documented this week: the same paste-this-command technique, delivered from inside a browser extension the victim installed themselves.

What to do

  • Audit your extensions today and remove anything you do not actively use. Every one is code running on every page you visit.
  • Check what each one can do, not what it claims to do. Read on all sites is the permission that matters.
  • Treat a change of ownership as a reinstall decision — except you will not be told, so the practical version is to re-audit periodically.
  • Never enter a recovery phrase into anything on a computer that is not the hardware wallet's own interface.
  • On a machine holding crypto, run a separate browser profile with no extensions at all.
  • If you had any of these installed, assume credentials are gone. Rotate, and move funds from any wallet touched.

What is not established

  • Who is behind it. Explicitly unknown.
  • Whether the extensions have been removed from the Chrome Web Store and Edge Add-ons.
  • How many users were actually affected, as distinct from installed counts.
  • How much was stolen. No figure.
  • Whether the February 2024 start date is firm — Socket says the campaign may have been active that long.