Superior: Crypto and Credential Theft via Browser Extension Acquisition and Malicious Updates

1. Basic Information

• Article Title: Chrome Web Store extensions caught stealing crypto, browser data
• Publisher: BleepingComputer
• Publication Date: 2026-08-30
• Source: BleepingComputer
• Related Source: Socket Threat Research
• Related Malware, Threat Groups, CVEs, and Products: Superior, Google Chrome, Microsoft Edge, Chrome Web Store, Microsoft Edge Add-ons
• Severity: High

2. Executive Summary

Threat actors published custom or acquired Chrome and Edge extensions in a harmless state to build a user base before pushing malicious updates. After the update, the extensions received encrypted JavaScript modules from a command and control (C2) server, stripped Content Security Policy (CSP) headers from web pages, stole cryptocurrency wallets, credentials, session data, and browsing history, and displayed ClickFix-style fake update prompts.

3. Attack Flow

Distribution via Abused Extension Trust

1. Threat actors publish a harmless extension with practical features or acquire an existing extension with an established user base from its original author.
2. Users install the extension, and the browser automatically updates it to newer versions by default.
3. Threat actors publish a new version containing malicious code and distribute it to existing users. The change in extension ownership is not explicitly notified to users.

Module Retrieval and In-Page Execution

1. The background service worker generates a unique installation UUID and establishes a WebSocket connection with the C2 server.
2. The extension stores the JavaScript modules received from the C2 server in chrome.storage.local encrypted with AES-GCM, using a key derived from the extension ID and installation UUID.
3. The extension registers dynamic declarativeNetRequest rules to strip Content-Security-Policy response headers from browsed pages.
4. Content scripts set the malicious code as an event handler on a hidden DOM element, trigger the event, and execute the code in the main world of the web page.
5. Depending on the target site and user activity, the extension intercepts wallet operations, steals recovery phrases, obtains credentials and session tokens, transmits browsing history, or initiates ClickFix redirection.

4. Threat Actor Positioning and Execution Locations

• Threat actors control store update channels and C2 infrastructure as the publishers or post-acquisition owners of the browser extensions.
• The loader runs in the background service worker of the extension, and the retrieved modules execute in the main world of the web page viewed by the user.
• If a ClickFix attack succeeds, the commands pasted and executed by the user run locally on the device.

5. Visibility for Victims and Administrators

Victims

• Normal extensions used previously update automatically, often without any new installation prompts or clear warnings.
• Full-screen update and recovery pages resembling legitimate interfaces appear on official Ledger or Trezor sites, requesting 12-, 18-, or 24-word recovery phrases.
• Clicking legitimate Connect Wallet or Swap buttons redirects users to processes swapped out by the attacker.
• Fake Chrome update prompts may guide users to copy and execute commands on their devices via the clipboard.

Administrators

• Managed browsers contain known malicious extension IDs or unnecessary extensions with high privileges.
• WebSocket or HTTPS traffic originates from extension processes to C2 servers or Cloudflare Workers using domains such as .top, .pro, and .sbs.
• When ClickFix succeeds, shell or script execution environments launch immediately after the browser process.
• Identity providers (IdPs) or cryptocurrency services may exhibit reused existing sessions, operations from unusual sources and devices, and asset transfers.

6. Success and Failure Conditions

Success Conditions

• A user has installed or automatically updated to the malicious version of one of the 19 targeted extensions.
• The extension successfully reaches the C2 server and receives the JavaScript module appropriate for the target.
• For credential or session theft, the user has opened the target page and is in an input or logged-in state.
• For recovery phrase theft, wallet asset transfers, and command execution via ClickFix, the user follows the instructions or approval prompts on the fake interface.

Failure Conditions / Risk Mitigation

• Remove and block known malicious extension IDs and eliminate unnecessary extensions from managed browsers.
• Enforce an allowlist policy for extensions in enterprise environments and continuously monitor ownership and permission changes.
• Block DNS, WebSocket, and HTTPS traffic to the listed C2 servers, secondary distribution sites, and data exfiltration destinations.
• Educate users not to follow ClickFix instructions to paste commands, and use Endpoint Detection and Response (EDR) to control behaviors where shells spawn from browsers.

7. What Happens Upon Successful Exploitation

• Connection and swap operations for EVM, Solana, and Tron wallets are hijacked, tricking users into approving asset transfers to the attacker.
• Ledger and Trezor recovery phrases are stolen, compromising the entire corresponding wallet.
• Sessions, tokens, account details, and balance information for Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, and MetaMask are acquired.
• Usernames, passwords, email addresses, and form input values are harvested from input fields on arbitrary sites.
• Facebook and LinkedIn account information and browser history are transmitted.
• Successful ClickFix fake update redirection leads to command execution outside the browser on the device.

8. Observable Logs

• Email: Not the primary distribution vector for this incident. Review contemporaneous emails and chat URLs only if an alternative vector leading to ClickFix is suspected.
• Proxy/SWG/DNS: DNS, WebSocket, and HTTPS traffic to domains such as active-enable-right-click[.]top, api[.]enable-right-click[.]click, payload[.]siteinsight[.]bond, api[.]extensionanalyticspro[.]top, ws[.]site-signal[.]top, content[.]resonanceweb[.]top, lucky-random[.]sbs, and ggle-analytics[.]com.
• Endpoint/EDR: Known malicious extension IDs, extension directory modification timestamps, shell and script execution environments launched from the browser, and command execution following clipboard operations.
• Identity/IdP: Abnormal post-sign-in activity using existing sessions, unusual IP addresses, locations, or devices, token reuse, credential modifications, and MFA or recovery setting changes.
• SaaS/Cloud: Extension inventories in Chrome Enterprise Core or Microsoft Edge management features, enforced install, allow, and block policies, and modification history of extension IDs and version numbers.
• Network: Persistent WebSockets from the browser to C2 servers, destination changes following C2 instructions, Cloudflare Workers data exfiltration destinations, and traffic to wallet drainer distribution domains.

9. Attack Success Assessment

• Attack Attempt Observed (Success Unconfirmed): Known extension IDs, C2 domains, and store histories identified, but execution of the malicious version or data exfiltration is unconfirmed.
• User Interaction Confirmed: Installation or automatic updates of the target extension, inputting data into fake recovery screens, wallet approvals, or ClickFix paste operations confirmed.
• Initial Execution Confirmed: Evidence confirmed that the background service worker of the malicious version started, established a WebSocket connection to the C2, and stored modules.
• Malware Execution or Authentication Success Confirmed: Module execution via CSP removal rules and hidden DOM events, or successful service authentication using stolen sessions confirmed.
• Data Theft or Session Compromise Confirmed: Acquisition or exfiltration of credentials, recovery phrases, cookies, Bearer tokens, account details, or browsing history confirmed.
• Subsequent Compromise Confirmed: Cryptocurrency transfers, account setting modifications, device command execution originating from ClickFix, additional payloads, or lateral movement to other services confirmed.

10. Investigation Playbook

• Trigger: Detection of known malicious extension IDs, Superior-related domains, abnormal WebSockets from browsers, fake browser update screens, or suspicious cryptocurrency transfers.
• Initial Verification: Identify the target extension ID, version, installation and update timestamps, installation source, ownership change timeline, and executing browser profile. Preserve contemporaneous logs from DNS, Proxy/SWG, browser management, EDR, IdP, and target SaaS/crypto services.
• Endpoints: Inspect the extension directory, manifest.json, service workers, chrome.storage.local, dynamic declarativeNetRequest rules, browser history, clipboard, and browser child processes.
• Authentication/Cloud: Enumerate target services where users were logged in, and check for session reuse, abnormal operations, token and cookie expiration status, and changes to MFA or recovery settings.
• Subsequent Activity: Investigate cryptocurrency transfer destinations, account takeovers, ClickFix commands, additional downloads, persistence mechanisms, and impact on other devices or services.
• Containment: Force-remove and block the target extension across all devices, close the browser, and invalidate sessions. Update stored credentials and transfer affected cryptocurrencies to a secure, uncompromised new wallet. Isolate devices where ClickFix executed and investigate them as compromised endpoints. Deploy IOCs to DNS, Proxy/SWG, and EDR systems.
• Assessment Criteria: Do not assume data theft succeeded based solely on the presence of the extension; separately evaluate malicious version installation, C2 connection, module execution, data exfiltration, and subsequent actions.

11. Defense and Detection Ideas

• Single Events: Prioritize the detection of known extension IDs, name resolution or WebSockets to Superior-related domains, shell execution from browsers, and abnormal operations on cryptocurrency services.
• Time-Series Correlation: Correlate extension updates, C2 WebSockets, encrypted module storage, CSP removal, target site visits, and data exfiltration or asset transfers.
• Hunting: Audit all extension IDs, versions, and owners to identify extensions removed from stores, broad site permissions, declarativeNetRequest privileges, and content scripts matching all URLs. Search historical traffic for listed IOCs and unusual WebSockets originating from extension processes.
• Log Gaps: When browser extension versions, update history, WebSocket traffic, and internal browser storage are not recorded, it is difficult to distinguish between simple installation and malicious module execution.
• Priority Mitigations: Force-removal of known IDs, enforcement of allowlist policies, centralized logging of browser management, bulk session invalidation procedures, and extension bans on cryptocurrency-using devices.

12. Facts / Inference / Hypothesis

Facts

• Socket identified 18 Chrome extensions and 1 extension for Edge sharing common malicious code and operational methods.
• Among the 19 extensions, 14 were created by the threat actors and 5 were acquired from their original authors. All featured advertised functionalities in their initial versions, with malicious behaviors added in subsequent updates.
• Enable Right Click & Copy — Smart Unlock + OCR had approximately 70,000 users on Chrome and roughly 10,000 users on the equivalent Edge version when malicious features were added, though this does not mean every user installed the malicious version.
• The loader implemented C2 WebSockets, C2 rotation, dynamic exfiltration endpoints, CSP removal, and JavaScript injection into the main world of web pages.
• Socket observed 16 modules, confirming wallet drainers, recovery phrase theft, session and credential theft, social media information theft, browsing history exfiltration, and ClickFix redirection.

Hypothesis and Inferences

• Inferences: Confirming removal from stores does not eliminate the residual risk on devices that previously received automatic updates; internal inventories and communication logs must be verified. The mere presence of an extension and a C2 connection does not confirm successful compromise of individual accounts or wallets; correlation with target site interactions, data exfiltration, and subsequent activity is required.
• Hypotheses: No additional threat actor attribution hypotheses are established based on publicly available information at this time.

13. MITRE ATT&CK Mapping

• T1176 Browser Extensions (High): Threat actors distributed malicious updates to custom or acquired browser extensions.
• T1105 Ingress Tool Transfer (High): Background service workers received JavaScript modules from C2 servers.
• T1056.003 Input Capture: Web Portal Capture (High): Monitored input, modification, and focus events across all pages to harvest form values.
• T1539 Steal Web Session Cookie (High): Acquired session information, including cookies and Bearer tokens, from logged-in tabs.
• T1555.003 Credentials from Password Stores: Credentials from Web Browsers (Medium): Harvested credentials entered in browsers, though there are no reports of direct reads from the browser's stored credential database.
• T1059 Command and Scripting Interpreter (Medium): ClickFix prompts users to copy and paste attacker-specified commands for execution, though public information does not specify the exact interpreters for all operating systems.

14. Unknowns and Additional Investigations

• The number of devices where the malicious version was actually installed, the total number of victims, and the aggregate volume of stolen credentials and cryptocurrency.
• Related extensions beyond the 19 identified, unobserved modules, and active C2 or exfiltration servers.
• The identities of individuals or organizations that acquired the extensions and the attribution of the Superior operators.
• The final removal status of the Edge versions and the evaluation criteria used by each store for detection and removal.

15. Impact on SOCs and Organizations

Organizations that leave Chrome and Edge extension management to users cannot rely on official stores and historical reputation alone to ensure security. Particularly on devices handling cryptocurrency, finance, administrative consoles, and recruitment or sales social media, organizations must conduct urgent inventories of known IDs, enforce allowlist policies, monitor changes to ownership, permissions, and versions, visualize WebSockets, and control shell execution originating from browsers.

16. Summary by Target Audience

• For SOC Analysts: Search for known extension IDs and Superior-related domains, and chronologically review extension updates, C2 WebSockets, CSP removal, data exfiltration, abnormal sign-ins, and asset transfers.
• For Administrators: Force-remove target extensions and transition to an allowlist model for extensions. Perform session invalidation, credential changes, and wallet migrations on affected devices.
• For End Users: Never enter recovery phrases or copy and paste instructed commands on screens disguised as browser updates or wallet recovery prompts. Report to the management department if you used any of the affected extensions.