A large-scale campaign to steal digital assets has been uncovered in browser stores. During my analysis, 18 malicious extensions for Google Chrome and one for Microsoft Edge were found, which were aimed at draining cryptocurrency wallets and stealing users' confidential data. The combined audience of these add-ons reached an impressive 80,000 people, and Russian users were also among those affected.
Mechanics of the Hidden Threat
These extensions operate on a proven scheme: they load a modular framework designed to steal cryptocurrency, passwords, and browser history. At the same time, victims are shown advertisements that mask the malicious activity. The first traces of this activity date back to 2024, indicating the long-term and carefully planned nature of the attack.
Particularly alarming is the fact that many of these extensions were initially legitimate. Attackers bought them from developers and injected malicious code through automatic updates. For example, the extension Enable Right Click & Copy — Smart Unlock + OCR, which worked in Chrome and Edge, had a base of 70,000 users in Chrome and about 10,000 in Edge by the time it was infected. This is a perfect illustration of a trust attack: a user installs a useful tool that over time turns into a Trojan horse.
Technical Details and Scope of Impact
The malware establishes an encrypted WebSocket connection to command-and-control (C2) servers and loads JavaScript modules. It strips Content Security Policy (CSP) headers from visited websites, allowing scripts to be injected to intercept data on crypto exchanges and online services. The modules are capable of draining EVM, Solana, and Tron wallets by replacing the "Connect Wallet" and "Swap" buttons. Additionally, phishing pages are created that mimic the official websites of Ledger and Trezor hardware wallets to extract seed phrases.
Of particular interest is that the malicious code steals assets and account data from major exchanges, including Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, and Bybit, as well as from the MetaMask wallet. A separate function creates fake browser update notifications that push the victim toward actions deepening the infection. All of this happens unnoticed by the user, as the extension continues to perform its stated function.
Additional Attack Vectors
In parallel, other threats are being recorded. Scammers create fake services for checking crypto addresses for involvement in money laundering (AML), through which they deceive asset owners. A vulnerability was also identified in the "Screen Sharing" feature of Apple's macOS operating system, through which hackers gained unauthorized access to victims' computers.
To anyone who suspects they have installed such extensions, I strongly recommend considering their data compromised and immediately changing passwords. Those who stored cryptocurrency in affected wallets need to transfer assets to new addresses as soon as possible. Regularly checking the list of installed extensions and being wary of requests for broad permissions is a minimal but critically important set of security measures.
Analyst's opinion: This attack is a vivid example of how attackers exploit users' trust in the browser extension ecosystem. The industry needs to reconsider its approach to validating updates and monitoring developers, otherwise we will see even more sophisticated schemes disguised as legitimate software.