A large-scale crypto-asset theft campaign has been uncovered in popular browser stores. Through deep analysis, I managed to discover 18 malicious extensions for Google Chrome and one for Microsoft Edge, which target draining cryptocurrency wallets and stealing users' confidential data. The combined audience of two versions of one of the most dangerous add-ons reached 80,000 people, and a significant portion of the victims are Russian-speaking users.
Infection mechanics and hidden threat
The extensions, disguised as useful tools, load a modular framework designed to steal cryptocurrency, passwords, and browser history. On top of that, they display advertising banners to victims. The first signs of attackers' activity can be traced back to 2024, indicating a long-term and well-planned operation.
The key danger lies in the fact that some of the extensions did not contain malicious code at the time of publication in the Chrome Web Store. Five of the sixteen add-ons were purchased from their original developers, after which dangerous functions were introduced into them through automatic updates. This is a classic trust attack scheme, where a user installs a seemingly legitimate solution that later turns into a trojan.
One such extension — "Enable Right Click & Copy — Smart Unlock + OCR" — operated in Chrome and Edge. By the time the infection was discovered, its base in Chrome exceeded 70,000 installations, while in Edge it was about 10,000. All found add-ons have already been removed from the Chrome Web Store, however, the version for Edge, according to available data, remained available in the Microsoft store.
Technical details and attack methods
After installation, the program establishes an encrypted WebSocket connection with command-and-control (C2) servers and downloads additional JavaScript modules. The malware strips Content Security Policy (CSP) headers from visited sites and injects scripts through hidden HTML elements, allowing it to intercept data on crypto exchanges and online services.
The modules are capable of draining EVM, Solana, and Tron wallets by replacing the "Connect Wallet" and "Swap" buttons. For Ledger and Trezor hardware wallets, phishing pages are created to lure out seed phrases. The malicious code steals assets and account data from the largest exchanges — Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit — as well as from MetaMask. A separate feature involves fake browser update notifications that push victims into actions deepening the infection.
Additional threats and recommendations
Other attack vectors are also being recorded in parallel. Scammers create fake services for checking crypto addresses against money laundering (AML), through which they deceive asset owners. Additionally, hackers actively exploit vulnerabilities in operating systems, for example, in the macOS "Screen Sharing" feature, gaining unauthorized access to victims' computers.
Affected users need to immediately change all passwords, considering their data compromised. For those who stored cryptocurrency in affected wallets, I strongly recommend transferring assets to new addresses. Regularly checking the list of installed extensions and being cautious when granting permissions are basic but critically important security measures.
My comment: This campaign is a vivid example of the evolution of cyber threats: attackers no longer hack — they buy legitimate businesses and patiently wait. Users should reconsider their trust model toward browser extensions, preferring open-source solutions with minimally necessary access rights. Security in cryptocurrency is not only about protecting keys but also about the hygiene of the entire digital environment.