A large-scale cryptocurrency theft campaign via browser extensions has been uncovered during an in-depth analysis of the Google Chrome and Microsoft Edge ecosystems. This involves 18 malicious Chrome add-ons and one for Edge, which not only drain wallets but also collect sensitive user data. The combined audience of the two versions of one of the most dangerous extensions reached 80,000 people, and Russian users were among those affected.
How attackers bypass store protections
The attack mechanism is sophisticated. Five of the sixteen extensions were purchased from legitimate developers, after which malicious code was injected into them through automatic updates. This means that at the time of publication in the Chrome Web Store, the extensions appeared completely safe. The malicious payload was delivered later, allowing the attackers to bypass moderation and remain undetected for a long time.
One striking example is the extension Enable Right Click & Copy — Smart Unlock + OCR, which operated in both Chrome and Edge. At the time of infection, its user base in Chrome exceeded 70,000, while in Edge it was around 10,000. All discovered add-ons have already been removed from the Chrome Web Store, but the Edge version, according to available data, remained available in the Microsoft Store.
Technical details and threat geography
After installation, the extension establishes an encrypted WebSocket connection to command-and-control (C2) servers and downloads JavaScript modules. These strip Content Security Policy (CSP) headers from visited websites and inject malicious scripts through hidden HTML elements. This allows interception of data on cryptocurrency exchanges and other online services.
The modules are capable of draining wallets in the EVM, Solana, and Tron ecosystems by replacing the "Connect Wallet" and "Swap" buttons. Pages of Ledger and Trezor hardware wallets are forged to extract seed phrases. Additionally, the code steals assets and account data from major exchanges—Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit—as well as from MetaMask. The attack affects virtually all popular methods of storing and exchanging digital assets, not limited to the geography of a single country.
Recommendations and conclusions
Those who may have had infected extensions installed are strongly advised to consider their data compromised and immediately change their passwords. If cryptocurrency was stored in affected wallets, experts recommend transferring assets to new addresses. Externally, the extension continues to perform its stated functions, making the theft invisible to the user—this is precisely why the threat remained undetected for so long.
Meanwhile, security specialists are also recording other attack vectors: phishing services for checking addresses against money laundering (AML) lists and exploitation of vulnerabilities in macOS. A careful approach to installed extensions, regular review of their list and requested permissions—this is a basic but critically important level of protection.
Analyst's opinion: this campaign is a vivid example of how user trust in official extension stores becomes the primary attack vector. The industry needs to rethink its approach to moderation and update monitoring, otherwise we will see new waves of similar incidents with even more serious consequences.