These 19 Extensions Were Clean When You Installed Them. Then They Updated Themselves.

The most useful thing about a browser extension is that it updates itself. That is also the entire attack.

Researchers at Socket have documented a campaign of 19 browser extensions, 18 on Chrome and one on Edge, that shipped a multi chain cryptocurrency wallet drainer along with credential theft, browser history collection and a module for faking browser update prompts. Socket tracks the operation as Superior, a name lifted from strings inside the malicious JavaScript.

Almost none of these extensions were malicious on the day they were installed. That is the part worth sitting with.

The business model is patience

A malicious extension uploaded on day one gets caught. Store review is imperfect, but it is reasonably good at spotting an obvious wallet drainer in a fresh submission with no users and no history.

So the operators do not do that. They publish something that actually does what it says. A tool that unlocks copy protected pages. An SEO statistics overlay. A crypto price ticker. An ad spying utility. A screen search helper. Ordinary, mildly useful things that solve a small annoyance well enough to earn reviews and installs.

Then they wait. Months, in this case. The extension builds a user base, accumulates positive ratings, and settles into the background of tens of thousands of browsers. And then a routine version bump arrives carrying code that was never there before.

Your browser installs it silently. That is the designed behavior, and it is the right default for security patches. It is also a standing invitation, because the trust decision you made was about the version you reviewed, and nothing asks you to make that decision again.

Buying the reputation instead of building it

Fourteen of the nineteen extensions were created by the threat actors themselves. The remaining five were acquired from legitimate developers, and that detail is the genuinely new problem.

There is a quiet market for browser extensions with real install bases. A developer builds a useful little tool as a side project, maintains it for a few years, gets tired of the support burden, and receives an unsolicited offer. From their perspective it is a clean exit for something they were about to abandon. From the buyer’s perspective it is a pre approved pipeline into tens of thousands of browsers, complete with the trust signals that take years to fake: install count, review history, an established listing.

Nothing about that transaction is visible to you. The listing keeps its name, its icon, its reviews and its rating. The ownership change generates no notification. The first evidence anything happened is behavior, and by then the code is already running.

What the payload actually did

The modules are unusually complete, which is what earns this the label of a framework rather than a single piece of malware.

Two of those deserve particular attention.

The seed phrase pages are the most damaging component by a wide margin. A drained hot wallet is a bad day. A stolen recovery phrase is permanent and total, because it reconstructs every account derived from it, on every device, forever. There is no reset. The one rule that covers this entirely is that a recovery phrase is typed into a hardware device and nowhere else, ever, for any reason, no matter how legitimate the page looks.

ClickFix is the one that catches technically confident people. It shows a fake browser update banner and asks you to paste a command into a terminal or the Run dialog to complete it. It works because it inverts the usual instinct: instead of tricking you into clicking something, it recruits you as the one who executes the code. Nothing malicious was downloaded and run behind your back. You typed it in yourself.

The WebSocket channel is what makes cleanup ugly. Because the extension pulls payloads from a live server rather than shipping them in the package, its behavior can change at any moment, and the version that got reviewed is not necessarily the version that ran. When the Chrome extension was identified and removed, the operators published an updated Edge version pointing at a fresh command domain on August 14, and Socket reported that one was still active.

The structural problem nobody has solved

Extension stores are stuck between two failure modes. Review every update by hand and security patches arrive days late, which gets people hurt. Auto update silently and a purchased listing becomes a delivery mechanism, which also gets people hurt.

The current compromise leans heavily on automation and on catching bad behavior after publication, which is why these campaigns run for months before anyone notices. Neither store surfaces a change of ownership to existing users, and neither re-prompts when an update meaningfully expands what an extension does with the permissions it already holds. Those two gaps are where this entire campaign lived.

It also fits a pattern that has been building all year. The most effective attacks right now are not breaking authentication, they are arriving with valid credentials already in hand. We saw the same shape this week in the infostealer campaign hijacking Claude sessions with stolen cookies, where two factor authentication was never given a chance to matter. An extension you already approved and a session you already authenticated are the same trick pointed at different targets.

The honest read

You cannot audit an extension you already installed, because the thing you would be auditing changes on its own schedule. What you can do is shrink the number of extensions that have permission to read every page you visit, and keep anything touching money away from the browser doing everything else.

Most people are carrying five to fifteen extensions and could not name what half of them do. Going through that list and deleting the ones you no longer use takes about two minutes and removes more risk than any security tool you could install afterward. It is unglamorous advice, which is usually a sign that it works. The alternative is finding out the hard way, and crypto losses have a way of being permanent in a manner that still fascinates people a decade later.