# The Browser Extension That Drained Your Wallet Was There for Months Before Anyone Noticed
The threat actor didn't rush. They published clean extensions, let users install them, accumulated reviews and a reputation, then pushed the malicious update. By the time the crypto was gone, the extension looked exactly like it always had.
That patience is what makes the "Superior" campaign — named and tracked by Socket Security — worth examining carefully. Researchers disclosed 19 browser extensions this week harboring wallet-stealing and cryptocurrency-draining code, but the more important story is how long this has been running and how the attack model exploits the fundamental trust architecture of browser extension stores.
## Buy the Trust, Then Weaponize It
Socket researcher Karlo Zanki identified 18 Google Chrome extensions and one Microsoft Edge extension published over the last six months, all sharing code patterns and tradecraft consistent with a single threat actor. The campaign appears to date back to at least February 2024 — a two-and-a-half-year operation that evaded systematic detection.
The playbook splits into two tracks. The actor created 14 extensions outright, pushing them through Chrome Web Store review with clean functionality intact. The remaining five they simply purchased from original developers — acquiring the install base, the star ratings, and the user trust that took someone else months to build.
Once embedded, the extensions do exactly what extensions are supposed to do, which is the point. They also connect to command-and-control infrastructure, establish persistent WebSocket connections, and can execute arbitrary code on the host browser. The data flowing back includes wallet secrets and session credentials.
The extension with the broadest blast radius is "Enable Right Click & Copy — Smart Unlock + OCR," sitting at 80,000 combined installs across Chrome and Edge. That's 80,000 browsers where a WebSocket is open, waiting.
## What's Actually Running in Your Extensions
The full list reads like a curated trap for crypto-adjacent users. Among the extensions created by the threat actor:
The targeting is deliberate. Someone running a DeFi portfolio tracker has crypto. Someone using a Ledger wallet checker almost certainly has assets worth stealing. The actor didn't cast wide — they went after users who'd already signaled what they hold.
The five purchased extensions skew toward productivity and utility tools: right-click unlockers, PDF protection, a Google Lens clone. These reach a broader population, including users who may have crypto wallets installed alongside generic browser tools. Compromise the productivity extension, and you get access to everything else the browser touches.
## This Isn't the First Warning
"QuickLens - Search Screen with Google Lens" was flagged earlier this year by both Annex Security and monxresearch-sec researchers, who documented its ability to push malware downstream, inject code, and harvest data. DomainTools Investigations published related findings in May 2025, catching the actor building fake websites impersonating productivity tools, VPN services, and crypto utilities to funnel users toward malicious Chrome Web Store listings.
The Socket findings extend the scope significantly. What looked like a handful of bad actors packaging shady extensions turns out to be a coordinated, long-running campaign with consistent code signatures across 19 extensions spanning multiple categories.
## The Review Process Isn't Built for This Attack
Google and Microsoft review extensions before publishing them. That review caught nothing here, which reflects a real structural limitation: when the initial submission is genuinely clean, automated and manual review validates what's actually there. The malicious update comes later, after the extension has cleared scrutiny.
Chrome Web Store policy prohibits this behavior. But policy enforcement requires detection, and detection requires either users reporting anomalies or Google catching update-based malicious payloads at scale. The Superior campaign's longevity suggests neither happened reliably.
This is an increasingly documented pattern. The xz Utils backdoor used a similar slow-burn approach — years of legitimate contribution before the payload arrived. Extension hijacking campaigns have hit Chrome Web Store repeatedly since at least 2017. The supply chain attack surface that gets the most attention is npm packages and GitHub Actions; browser extensions draw less scrutiny despite sitting inside the browser's full trust boundary.
---
## HackWire Analysis
The Superior campaign is a case study in why "it was reviewed by Google" is not a security control.
The extension purchase angle deserves more attention than it's getting in early coverage. When a developer sells an extension to an unknown buyer, their users have no way to know. There's no ownership disclosure in the Chrome Web Store UI. The extension keeps its name, its icon, its five-star reviews. The install count on "Enable Right Click & Copy" didn't grow to 80,000 under the threat actor — it was acquired with those users already inside it.
This is a supply chain attack with a remarkably low technical barrier. Buying a legitimate extension requires no exploit, no zero-day, no social engineering of a developer. It requires money and patience. The threat actor used both.
The WebSocket persistence mechanism is the detail defenders should sit with. A WebSocket connection isn't a one-time data exfiltration — it's an ongoing channel. The C2 can push commands, update behavior, and respond to what's happening on the victim's machine in real time. These extensions aren't just stealing; they're maintaining access.
For security teams managing browsers in enterprise environments, the actionable response is narrower than it looks. Most organizations can't enumerate every extension installed across their fleet without dedicated tooling. Browser management platforms (Google Chrome Enterprise, Microsoft Endpoint Manager for Edge) can enforce extension allowlists — but that requires someone deciding which extensions are permitted, which is work most IT shops haven't done.
Individual users should audit their extension list now, remove anything they don't actively use, and treat extension update permissions as meaningful. The "Superior" actor isn't done. Two and a half years in, with 19 extensions and counting, this is a going operation.
— HackWire Editorial
---
## Related Coverage