Crypto‑Stealing Chrome & Edge Extensions Linked to ‘Superior’ Campaign

Why it matters

Someone slipped malicious code into dozens of browser add‑ons, turning ordinary Chrome and Edge users into crypto‑draining victims.

One extension alone sits on roughly 80 000 machines – a foothold big enough to fund further operations.

Technical rundown

The 19 extensions, published over the past six months, either started clean and were later hijacked or were bought outright from previous owners. Fourteen were authored by the campaign, five were acquired.

Each extension opens a persistent WebSocket back‑channel, dubbed “Superior” by the tracking platform Socket. The C2 can swap endpoints on the fly, letting the operators steer payload delivery.

When activated, the code strips CSP headers and drops up to 16 JavaScript modules. Those modules perform a laundry list of theft: wallet draining, seed‑phrase harvest, credential grab, social‑media account hijack, browser‑history export, and a ClickFix‑style lure that pretends to be a browser update and asks users to copy‑paste a malicious command.

Sample malicious add‑ons

• koccklolohdacbfooifnpebakpbeipc – “Enable Right Click & Copy — Smart Unlock + OCR” (≈80 k installs)
• fegckejpfnlmfgkfjpinlbgmeeijjkel – “RapidLens”
• “QuickLens – Search Screen with Google Lens” (previously flagged by Annex Security and monxresearch‑sec)

Who’s at risk

Anyone who installed extensions from the Chrome Web Store or Edge Add‑ons catalog during the last half‑year could be affected. The campaign targets users of both browsers, regardless of platform.

Defensive steps

1. Audit installed extensions. Remove any you don’t recognize, especially those listed above.
2. Enforce an enterprise allow‑list for browser add‑ons; block installations from unknown publishers.
3. Monitor network traffic for outbound WebSocket connections to uncommon domains, a hallmark of the “Superior” C2.
4. Refresh CSP policies in your web applications; the malicious extensions attempt to strip them.
5. Educate users that browsers never ask you to copy‑paste commands for updates. Any such prompt should be reported.

Open questions

The operators remain unidentified. While the campaign’s activity spans at least six months, its full timeline is still being pieced together.