Five useful browser extensions changed owners and later delivered malware through routine updates. A Socket investigation published August 27 found them among 18 Chrome extensions and one Microsoft Edge extension sharing a modular system for stealing wallet secrets, account sessions, passwords and browsing history.
“Socket identified 19 malicious extensions published in the last six months, delivering an extendable malware framework,” researcher Karlo Zanki wrote. Socket is a security vendor reporting its own code and infrastructure analysis. Its report traces related activity to February 2024, yet it does not quantify confirmed victims, completed theft or total losses.
The largest acquired extension, Enable Right Click & Copy: Smart Unlock + OCR, had about 70,000 Chrome users when malicious code appeared. A matching Edge version had about 10,000. Socket calls that roughly 80,000 people a potential exposure surface; it cautions that the count does not prove every user received the malicious build.
Trusted extensions received malware
Fourteen listings began as attacker-created utilities. Five began as working products and were bought from their developers. Each followed the same trust-building pattern: publish clean functionality first, then add the malicious framework in a later release.
Chrome checks for extension updates at startup and periodically by default. That makes an ownership change consequential even when a user installs nothing new. Socket said Google had removed the identified Chrome listing before the report appeared. The corresponding Edge listing was still active and serving malware, and Socket had reported it to Microsoft. The source includes no Microsoft response.
The 19 published IDs give administrators a durable inventory key even when names change:
| Origin | Extension | ID |
|---|---|---|
| Acquired | Enable Right Click & Copy: Smart Unlock + OCR | pkoccklolohdacbfooifnpebakpbeipc |
| Acquired | RapidLens | fegckejpfnlmfgkfjpinlbgmeeijjkel |
| Acquired | QuickLens | kdenlnncndfnhkognokgfpabgkgehodd |
| Acquired | Password Protect PDF | jamminefolhgepgihbmcjjhgldbfcikp |
| Acquired | Allow Copy: Edge | inmkjedjdhgpknjogbjomhnbgdccckkg |
| Actor-created | PixelCheck | fcgdejjichpgfaaafflplhfijcnieopb |
| Actor-created | Creative Library | cfpnjdbpojpcongfaefcamjbaolpelcd |
| Actor-created | MirrorSphere SEO Stats | aapdalkmclfaahehnmicbglkohkldhne |
| Actor-created | Site Signal | dkdadldmiefjldmegbjbnhhfddnkhlhm |
| Actor-created | SEO Pulse Pro | fjmlhlkccegopebcllcmafahkmeejpph |
| Actor-created | Private Crypto News Reader | iekoapohahgmogbagegmcgplbkikcgke |
| Actor-created | Blockfolio Address Monitor | ahpnnnjbnfbhoikhohglpohnoocjcoco |
| Actor-created | Crypto Rates & Fiat Converter | oeacadlaclegkkkdehjmiifnjhcekclj |
| Actor-created | Crypto Alerter | jmlgannjlbliikgcaieomgmcnfplglea |
| Actor-created | DeFi Pulse Tracker | lhmcajhgadanidbopgaoobjlldegjmke |
| Actor-created | Crypto Price Badge | gfackggoapepdmnjnkblogdcjpgcjiak |
| Actor-created | Multi-Chain Explorer | hfijkbdkpidafdbeebnnkhfccildbcle |
| Actor-created | LedgerLook | pcngchfbfgejllcbhmeadjhiebebiome |
| Actor-created | FeedX-Ray | aodkjdeghbjiaienipfjkbpcikkacbcp |
One loader rewrites every page
The background service worker creates an installation identifier and maintains a WebSocket channel to a command server. Instructions can replace the original command endpoint and assign a separate exfiltration destination. Socket observed that rotation in operation. Downloaded JavaScript modules are encrypted with AES-GCM and stored under the nodes key in chrome.storage.
The extension then registers a browser rule that removes Content Security Policy headers from every main frame, subframe and XMLHttpRequest. Content scripts place hidden image, input or form elements into visited pages, attach downloaded code as event handlers and fire the events in the page’s main execution world. The elements disappear immediately afterward.
Long description
The linear diagram starts with an automatic update to a browser extension. Its service worker opens a persistent WebSocket channel and can receive a replacement command server and separate exfiltration destination. Downloaded JavaScript modules are stored in extension-local storage. A browser rule removes Content Security Policy headers, after which hidden page elements trigger the modules in the website’s main JavaScript world. The final stage lists wallet draining, session theft, form capture and fake-update execution as observed outcomes.
Sixteen modules target secrets
Socket observed 16 modules delivered to the Enable Right Click & Copy extension. One family cloned real connect or swap buttons for EVM, Solana and Tron wallets and drove approval flows. Another replaced pages on trezor.io and ledger.com with false recovery wizards that captured 12-, 18- or 24-word seed phrases. Those are legitimate wallet sites being impersonated inside a compromised browser page.
Other modules read authenticated session material for OKX, MEXC, Kraken, KuCoin, Coinbase, Binance, Bybit and MetaMask. A general grabber captured text, password and email fields across pages and same-origin frames. Separate modules harvested Facebook and LinkedIn data, copied browser history, or displayed a ClickFix-style browser update that placed an attacker-supplied command on the clipboard.
The framework can download different modules later. The published list proves observed capability in analyzed samples. It does not establish that every extension delivered every module or that every exposed browser lost data.
Match extensions and infrastructure
Start with managed-browser inventory. Match the 19 IDs above against Chrome and Edge policy, extension-installation records, browser profiles and forensic images. Preserve the installed version, update time, permissions and extension-local storage before removal. A store takedown does not remove an already installed copy or explain what it accessed.
Search DNS, proxy and browser telemetry for Socket’s primary command domains:
active-enable-right-click[.]top, api[.]enable-right-click[.]click, enable-right-click[.]click, payload[.]siteinsight[.]bond, api[.]extensionanalyticspro[.]top, password-protect-pdf[.]com, privatecryptonewsreader[.]pro, cryptoratesfiatconverter[.]pro, cryptopricebadgequickglance[.]pro, ws[.]site-signal[.]top, content[.]resonanceweb[.]top, api[.]creativelibrary[.]top, api[.]codefilearc[.]net, ws[.]seopulsepro[.]sbs, relay[.]seopulsepro[.]sbs, defipulsetracker[.]pro, blockfolioaddressmonitor[.]pro, pricealarmsvolatilitywarnings[.]pro, extension[.]io-safe[.]icu and feedback[.]feedx-ray[.]top.
The additional set is lucky-random[.]sbs, cookie-whitelist[.]top, whale-alert[.]art and ggle-analytics[.]com. The campaign also used pipi.saghirmohamed19.workers.dev and mimi.saghirmohamed19.workers.dev as exfiltration sinks. Those two hostnames sit on Cloudflare Workers, a legitimate shared service, so keep them in context and correlate a match with one of the listed extension IDs, unexpected WebSocket traffic, the nodes storage key or CSP-removal rules.
Verify browsers and accounts
Remove a matched extension through browser management, revoke its allowed installation policy and retain the profile for investigation. Reset sessions and credentials entered through the affected browser during its malicious-version window. For wallet users, move assets to a new wallet whose recovery material was created on a clean device; changing a website password cannot invalidate an exposed seed phrase.
Verify containment with a four-part comparison: managed inventory contains none of the 19 IDs, retained browser evidence has a disposition for every prior match, network telemetry shows no subsequent contact with the published infrastructure, and affected identities have new sessions or credentials. The expected result is an explained timeline for each exposed browser and no unexplained extension-driven traffic or account activity after containment. Socket’s primary research supplies the code behavior and indicator set for that comparison.