# The Extensions You Trusted Were Sold to Someone Who Wanted Your Crypto
Somewhere in 2024, a threat actor started buying browser extensions.
Not building them. Buying them — approaching developers who'd built legitimate, well-reviewed Chrome and Edge add-ons and purchasing their user bases outright. Then, quietly, they pushed malicious updates to those now-trusted extensions and watched 80,000 wallets walk into range.
That's the core of what researchers at Socket uncovered this week: a coordinated campaign that weaponized at least five previously clean Chrome extensions through acquisition, then used them as the delivery mechanism for a 16-module malware framework designed explicitly to drain cryptocurrency and harvest browser-stored credentials. The campaign, Socket believes, has been running since at least early 2024.
## How You Buy a Malware Distribution Network for the Price of an App
The acquisition model is what makes this campaign distinctly dangerous, and it's not new — but it keeps working because no one has figured out how to defend against it at scale.
Here's the problem the extension ecosystem has never solved: a browser extension's trust level is inherited from the moment of installation, not continuously re-evaluated. If you installed an extension six months ago because 70,000 people were using it and the reviews were solid, your browser still trusts it completely after ownership changes hands and the code changes entirely. Chrome and Edge don't prompt you when an extension's author changes. They don't flag ownership transfers in the permission UI. They just deliver the update.
The "Enable Right Click & Copy — Smart Unlock + OCR" extension is the clearest example here. At the point it turned malicious, it had 70,000 Chrome users and 10,000 Edge users — all of whom had presumably installed it for the mundane, completely legitimate reason of copying text on copy-protected websites. The extension did its job. Users trusted it. Then the update landed, and so did the malware.
Google caught it and pulled it. Microsoft was slower — at the time Socket published its report, the Edge version was still live in the Microsoft Add-ons Store. That gap matters. Every hour an extension stays in a marketplace after confirmed malicious behavior is another hour of active distribution.
## What the Framework Actually Does
The technical architecture is worth understanding, because this is not a grab-and-go credential stealer thrown together in an afternoon. Socket found 16 distinct modules, and the researchers explicitly describe the framework as "highly extensible" — meaning whoever built this was thinking about future payloads from day one.
The infection chain: once the malicious extension is running, it establishes an encrypted WebSocket connection to command-and-control infrastructure. It downloads JavaScript modules dynamically. Then — and this is the part that should alarm anyone thinking about defense — it strips Content Security Policy headers from every single website the victim visits.
CSP exists specifically to block the injection of unauthorized scripts into web pages. Removing it silently from every site the browser loads essentially gives the attacker a blank check to inject anything, anywhere. From that point, hidden HTML elements carry the malicious scripts into whatever financial or social platform the user opens.
The targeting is comprehensive and precise:
The combination of ClickFix and wallet-draining in the same framework is notable. ClickFix has been associated with multiple separate threat actors over the past 18 months. Either this group borrowed the technique from public reporting, or there's shared tooling somewhere in the ecosystem.
## The Crypto Industry Has a Browser Problem It Hasn't Admitted Yet
The concentration of targets here tells a story. Every major centralized exchange, every major hardware wallet brand, the dominant software wallet, and multiple DeFi interaction points — this campaign was built specifically for the segment of users who hold meaningful crypto assets and access them through a browser.
Hardware wallets were supposed to solve the browser trust problem. If your private keys never leave your Ledger, a compromised computer shouldn't be able to drain your wallet. That's the pitch. But replacing the Ledger website with a phishing clone that prompts seed phrase entry sidesteps the hardware entirely. The browser extension doesn't need to touch your keys if it can convince you to hand them over voluntarily.
The users most at risk here aren't the most sophisticated. They're the people who installed a utility extension years ago, never thought about it again, and now maintain crypto positions across three or four platforms because that's just what you do in 2026. Those users have no realistic mechanism to audit what their extensions are doing in the background.
---
## HackWire Analysis
The extension acquisition attack vector has shown up before — the DataSpii campaign in 2019 used a similar playbook, buying extensions from developers to access their user bases for surveillance purposes. The security community documented it thoroughly. Browser vendors acknowledged the problem. And then, functionally, nothing changed about how extension ownership transfers are handled or disclosed to users.
What's different in 2026 is the payoff. In 2019, harvested browsing data had value as corporate intelligence. In 2026, a single successful seed phrase capture can move hundreds of thousands of dollars in seconds with no recourse. The incentive structure for running these campaigns has grown by an order of magnitude while the defensive infrastructure has remained essentially static.
The CSP-stripping behavior deserves more attention than it's getting in the coverage of this story. Most browser extension security conversations focus on what permissions an extension requests at install time. But an extension that can remove CSP from every page you visit has effectively neutered a major class of web security controls for the duration of every browsing session. That's a system-level trust violation, not a narrow data access issue. Browser vendors should be treating CSP header modification by extensions as a high-privilege operation requiring explicit user consent — the same way they treat webcam access.
The Edge response lag is also a pattern. Google has invested significantly in automated malicious extension detection over the past three years; Microsoft's equivalent infrastructure appears meaningfully behind. For enterprises allowing personal browser extensions on managed devices — and most still do — that gap represents real risk. Security teams that haven't locked down extension installation policies on Windows endpoints running Edge should move that item up the priority list.
Anyone who had these extensions installed should treat all credentials stored in that browser as compromised and rotate them. Crypto users should generate fresh wallets and migrate assets before doing anything else.
— HackWire Editorial
---
## Related Coverage