A large-scale crypto asset theft campaign has been uncovered in popular browser stores. Through in-depth analysis, I managed to identify 18 malicious extensions for Google Chrome and one for Microsoft Edge that functioned as full-fledged "wallet drainers," emptying users' wallets and stealing confidential data. The combined audience of just two versions of one of these add-ons reached 80,000 people, and a significant portion of the victims are in Russia.
The attack mechanics are meticulously designed. The malicious code was not visible from day one. The attackers purchased legitimate extensions from their original developers, then injected a dangerous modular framework through automatic updates. This allowed the attack to remain undetected for months, with the theft functionality activating selectively and as needed.
Technical details and threat geography
One of the most telling examples is the extension Enable Right Click & Copy — Smart Unlock + OCR, which was distributed in both Chrome and Edge. Its base in Chrome exceeded 70,000 installations, and in Edge about 10,000. After installation, the program established an encrypted WebSocket connection to a command-and-control (C2) server, downloaded additional JS modules, and removed Content Security Policy (CSP) protection on websites. This allowed it to intercept entered data and replace interfaces.
The range of stolen data is particularly alarming. The modules target draining EVM, Solana, and Tron wallets by replacing the "Connect Wallet" and "Swap" buttons. The attackers create phishing copies of Ledger and Trezor websites to extract seed phrases, and also steal credentials and assets from major exchanges: Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, and MetaMask. Additionally, the extensions collect passwords, browser history, and data from Facebook and LinkedIn accounts.
Although all found extensions have already been removed from the Chrome Web Store, the Edge version, according to my data, remained available in the Microsoft store longer. The first traces of this campaign's activity date back to 2024, indicating its long-term and systematic nature.
Recommendations and conclusions
To anyone who suspects they have installed such add-ons, I strongly recommend considering their data compromised. It is necessary to immediately change passwords and transfer crypto assets to new, clean addresses. Storing funds in hot wallets, especially with extended access rights, is now extremely risky.
This attack is another reminder that the browser extension ecosystem remains a "gray zone" of security. Even time-tested tools can be bought out and turned into trojans. Regularly auditing the list of installed extensions and being skeptical of requests for broad permissions is not paranoia but necessary hygiene for anyone working with digital assets. The market responds to threats, but attackers are always one step ahead, so user vigilance is the last and most important line of defense.