A large-scale cryptocurrency theft campaign has affected users worldwide, including Russia. In a threat analysis I conducted, based on industry research data, 18 malicious extensions for Google Chrome and one for Microsoft Edge were discovered. The combined audience of two versions of one of these add-ons reached 80,000 people, making the attack one of the most massive in recent times.
Infection mechanics: purchasing legitimate extensions
A key feature of this scheme is an attack on trust. The attackers did not create malicious code from scratch but bought popular extensions from their original developers. Five of the sixteen analyzed modules were infected in this way. Malicious functions entered the code only after installation, through automatic updates, allowing them to remain undetected for a long time.
For example, the extension Enable Right Click & Copy — Smart Unlock + OCR functioned in Chrome and Edge. By the time it was discovered, its base in Chrome exceeded 70,000 users, while in Edge it was about 10,000. The first traces of the malicious framework's activity date back to 2024, indicating the long-term and well-planned nature of the operation.
What exactly is stolen and how it works
After installation, the extension opens an encrypted WebSocket connection to command-and-control (C2) servers and loads JavaScript modules. The program removes Content Security Policy (CSP) headers from websites and injects hidden HTML elements to intercept data. This allows it to replace "Connect Wallet" and "Swap" buttons with phishing ones, as well as create fake pages to steal seed phrases from Ledger and Trezor hardware wallets.
The malicious code targets draining EVM, Solana, and Tron wallets. It also steals assets and account data from major exchanges, including Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, and from MetaMask. Additionally, the extensions intercept passwords, browsing history, and Facebook and LinkedIn account data, as well as display advertising lures. Externally, the extension continues to perform its stated functions, so the victim remains unaware of the compromise for a long time.
Other threats and recommendations
Alongside this campaign, there is a rise in phishing services that mimic AML address checks. Attackers are also actively exploiting vulnerabilities in macOS, gaining unauthorized access to victims' computers.
All detected extensions have already been removed from the Chrome Web Store, but the Edge version remained available in the Microsoft Store. Anyone who installed such add-ons should consider their data compromised. Change your passwords and transfer crypto assets to new addresses. Regularly checking the list of active extensions and being wary of requests for broad permissions is a minimum set of security measures.
My comment: this attack is a vivid example that even "verified" extensions from official stores do not guarantee security. The industry needs to rethink its approach to validating updates and transferring extension rights, otherwise we will see even more sophisticated schemes.