Keypoints
- Socket identified 19 malicious extensions: 18 for Chrome and 1 for Edge, all sharing code and operational similarities.
- The activity is linked to the “Superior” campaign, which dates back to February 2024 and overlaps with prior DomainTools and Secure Annex reporting.
- The malware framework uses a persistent WebSocket C2 channel, encrypted module delivery, and the ability to rotate C2 and exfiltration endpoints dynamically.
- Attackers strip Content Security Policy headers and use hidden DOM elements plus injected event handlers to execute malicious JavaScript in the main world.
- Primary objectives include wallet secret theft, crypto draining, credential harvesting, browser-history theft, and account/session abuse across major services.
- The most impactful extension was “Enable Right Click & Copy — Smart Unlock + OCR,” originally built by PreppHint and later acquired by the threat actor, exposing up to 80,000 users across Chrome and Edge.
- Several malicious extensions were removed from the Chrome Web Store, but the Edge version of the high-impact extension remained active at the time of reporting.
MITRE Techniques
- [T1027 ] Obfuscated Files or Information – Payload modules are encrypted and stored before execution, making analysis harder (‘Incoming WebSocket messages deliver malicious modules in form of JavaScript snippets that get encrypted and stored in the nodes Chrome local storage key.’)
- [T1071.001 ] Web Protocols – The malware maintains C2 over WebSocket with heartbeat and message exchange (‘The latest malware versions build and maintain a persistent WebSocket connection, with 5-minute heartbeat interval.’)
- [T1112 ] Modify Registry / Configuration? – Better match is Modify System Settings – The extension changes browser security behavior by stripping CSP headers (‘registers a dynamic declarativeNetRequest browser rule that strips Content-Security-Policy headers from every page’)
- [T1056.001 ] Keylogging – The credential-grabber captures input across text, password, and email fields (‘hooks focus, input, change, blur, and mutation events across every text, password and email input on every page’)
- [T1185 ] Browser Session Hijacking – Attackers collect cookies, bearer tokens, and authenticated session material from logged-in tabs (‘read balances and authenticated session material (cookies, bearer/authorization tokens, account/profile data) directly from the victim’s logged-in tabs’)
- [T1056.003 ] Web Portal Capture – The fake Ledger/Trezor flows capture recovery phrases entered into phishing pages (‘walks the victim through entering their 12/18/24-word recovery phrase, which is captured and exfiltrated’)
- [T1204.001 ] Malicious Link – While not a classic link, the lure presents fake update pages and commands to entice user execution (‘fake “Chrome — Update available” page that copies an attacker-supplied command to the clipboard’)
- [T1113 ] Screen Capture – The fake update lure uses OS-specific screenshots to guide the victim (‘uses OS-specific screenshots to instruct the victim to paste and run it’)
- [T1189 ] Drive-by Compromise – Malicious extension updates are pushed to an existing user base through auto-update (‘a new version is published, introducing the malicious behavior’)
- [T1055 ] Process Injection – Not literal process injection; closest observed behavior is injecting malicious code into web pages via hidden elements and handlers (‘create hidden DOM elements … allowing them to be executed in the main world’)
Indicators of Compromise
- [Domains] Primary C2 / content / exfiltration infrastructure – active-enable-right-click[.]top, api[.]enable-right-click[.]click, ggle-analytics[.]com, and other 12 domains
- [Domains] Secondary and sink infrastructure – lucky-random[.]sbs, pipi[.]saghirmohamed19[.]workers[.]dev, mimi[.]saghirmohamed19[.]workers[.]dev
- [Extension IDs] Malicious or weaponized extensions – pkoccklolohdacbfooifnpebakpbeipc, fegckejpfnlmfgkfjpinlbgmeeijjkel, and other 13 IDs
- [File/Code Modules] Malicious JavaScript module names – superior-trezor, superior-ledger, superior-grabber, superior-history, and superior-updater
- [Domains] Wallet-drainer hosting – cookie-whitelist[.]top, whale-alert[.]art, and related .top/.art domains
- [URLs] WebSocket C2 endpoint pattern – wss://api[.]active-enable-right-click[.]top/?uuid=…&extension=…
Read more: https://socket.dev/blog/chrome-edge-extension-wallet-drainer