{"id":"superior-chrome-edge-extensions-aug-2026","category":"supply-chain","status":"closed","title":"Superior malware in 19 Chrome and Edge extensions targets wallets and passwords","tldr":"Nineteen Chrome and Edge extensions carried Superior malware targeting passwords, browsing data and cryptocurrency. Remove the listed extensions, scan the computer and change exposed passwords. No verified safe replacement releases were identified.","summary":"Socket disclosed 19 malicious Chrome and Edge extensions carrying Superior malware on 27 August. Five had been bought from legitimate developers before being poisoned; the others initially appeared harmless too. Chrome automatically updates extensions, allowing malicious releases to reach existing users. One acquired utility had about 70,000 Chrome users and 10,000 Edge users: potential exposure, not confirmed infections. Observed payloads targeted passwords, account sessions, browsing history and cryptocurrency, including recovery phrases through fake Ledger and Trezor pages. Socket linked the operation to activity dating back to February 2024. PCWorld reported removal from both stores on 1 September, but no Google or Microsoft incident statement confirming complete removal was found. By 3 November, Socket still labelled the broader campaign ongoing, with activity last recorded on 21 September. Affected release numbers and verified safe replacement versions were not established. The reviewed sources provide no confirmed victim total, total losses or recovery outcome.","action":"Remove every listed extension you find in Chrome or Edge's extension manager and run a full antivirus scan. If you used an affected browser, change potentially exposed passwords from a clean device; if a wallet or recovery phrase may have been exposed, move the assets to a newly created wallet using a clean device. If you followed a fake update's instructions, ask a trusted IT professional to check for malware beyond the browser.","product":"19 Google Chrome and Microsoft Edge browser extensions","audience":"both","severity":"high","patch":"none","exploited":true,"cves":[],"tags":["chrome","edge","browser-extension","supply-chain","credential-theft","crypto","superior"],"affected":["Chrome: Enable Right Click & Copy — Smart Unlock + OCR","Chrome: RapidLens - Google Lens for Screen Search & Images","Chrome: QuickLens - Search Screen with Google Lens","Chrome: Password Protect PDF","Edge: Allow Copy - Select & Enable Right Click","Chrome: PixelCheck","Chrome: Creative Library - Ad Spy Tool","Chrome: Website Traffic Checker: MirrorSphere SEO Stats","Chrome: Site Signal - Website Traffic & SEO Checker","Chrome: SEO Pulse Pro - Website Traffic & SEO Analyzer","Chrome: Private Crypto News Reader","Chrome: Blockfolio: Address Monitor","Chrome: Crypto Rates & Fiat Converter","Chrome: Crypto Alerter: Price Alarms & Volatility Warnings","Chrome: DeFi Pulse Tracker","Chrome: Crypto Price Badge: Quick Glance","Chrome: Multi-Chain Explorer","Chrome: LedgerLook: Wallet Checker","Chrome: Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Ray"],"fixed":[],"matches":[{"platform":"chrome","app":"Enable Right Click & Copy — Smart Unlock + OCR","bundle":"pkoccklolohdacbfooifnpebakpbeipc","fixed":""},{"platform":"chrome","app":"RapidLens - Google Lens for Screen Search & Images","bundle":"fegckejpfnlmfgkfjpinlbgmeeijjkel","fixed":""},{"platform":"chrome","app":"QuickLens - Search Screen with Google Lens","bundle":"kdenlnncndfnhkognokgfpabgkgehodd","fixed":""},{"platform":"chrome","app":"Password Protect PDF","bundle":"jamminefolhgepgihbmcjjhgldbfcikp","fixed":""},{"platform":"edge","app":"Allow Copy - Select & Enable Right Click","bundle":"inmkjedjdhgpknjogbjomhnbgdccckkg","fixed":""},{"platform":"chrome","app":"PixelCheck","bundle":"fcgdejjichpgfaaafflplhfijcnieopb","fixed":""},{"platform":"chrome","app":"Creative Library - Ad Spy Tool","bundle":"cfpnjdbpojpcongfaefcamjbaolpelcd","fixed":""},{"platform":"chrome","app":"Website Traffic Checker: MirrorSphere SEO Stats","bundle":"aapdalkmclfaahehnmicbglkohkldhne","fixed":""},{"platform":"chrome","app":"Site Signal - Website Traffic & SEO Checker","bundle":"dkdadldmiefjldmegbjbnhhfddnkhlhm","fixed":""},{"platform":"chrome","app":"SEO Pulse Pro - Website Traffic & SEO Analyzer","bundle":"fjmlhlkccegopebcllcmafahkmeejpph","fixed":""},{"platform":"chrome","app":"Private Crypto News Reader","bundle":"iekoapohahgmogbagegmcgplbkikcgke","fixed":""},{"platform":"chrome","app":"Blockfolio: Address Monitor","bundle":"ahpnnnjbnfbhoikhohglpohnoocjcoco","fixed":""},{"platform":"chrome","app":"Crypto Rates & Fiat Converter","bundle":"oeacadlaclegkkkdehjmiifnjhcekclj","fixed":""},{"platform":"chrome","app":"Crypto Alerter: Price Alarms & Volatility Warnings","bundle":"jmlgannjlbliikgcaieomgmcnfplglea","fixed":""},{"platform":"chrome","app":"DeFi Pulse Tracker","bundle":"lhmcajhgadanidbopgaoobjlldegjmke","fixed":""},{"platform":"chrome","app":"Crypto Price Badge: Quick Glance","bundle":"gfackggoapepdmnjnkblogdcjpgcjiak","fixed":""},{"platform":"chrome","app":"Multi-Chain Explorer","bundle":"hfijkbdkpidafdbeebnnkhfccildbcle","fixed":""},{"platform":"chrome","app":"LedgerLook: Wallet Checker","bundle":"pcngchfbfgejllcbhmeadjhiebebiome","fixed":""},{"platform":"chrome","app":"Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Ray","bundle":"aodkjdeghbjiaienipfjkbpcikkacbcp","fixed":""}],"sources":[{"kind":"research","title":"19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads","url":"https://www.socket.dev/blog/chrome-edge-extension-wallet-drainer","by":"Socket","date":"2026-08-27"},{"kind":"advisory","title":"The Chrome Extension update lifecycle","url":"https://developer.chrome.com/docs/extensions/develop/concepts/extensions-update-lifecycle","by":"Google","date":"2025-09-08"},{"kind":"news","title":"Chrome Web Store extensions caught stealing crypto, browser data","url":"https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/","by":"BleepingComputer","date":"2026-08-30"},{"kind":"news","title":"19 Chrome extensions were secretly stealing data. Uninstall these now","url":"https://www.pcworld.com/article/3224561/19-chrome-extensions-were-secretly-stealing-data-uninstall-these-now.html","by":"PCWorld","date":"2026-09-01"},{"kind":"post","title":"Malicious Chrome and Edge add-ons and ClickFix attacks","url":"https://www.kaspersky.com/blog/clickfix-malicious-browser-extensions/56428/","by":"Kaspersky","date":"2026-09-17"},{"kind":"research","title":"Superior campaign tracker — checked 3 November 2026","url":"https://socket.dev/supply-chain-attacks/superior","by":"Socket","date":"2026-11-03"}],"started":"2026-08-27","closed":"2026-09-21","created":"2026-11-03T21:28:27.800Z","updated":"2026-11-03T21:28:27.800Z","cve_notes":[],"timeline":[{"at":"2026-09-21","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Socket's broader Superior tracker records this as its latest activity date and lists 23 unique packages. Checked on 3 November, the tracker still describes the campaign as ongoing.","url":"https://socket.dev/supply-chain-attacks/superior","by":"Socket","patch":null},{"at":"2026-09-17","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Kaspersky warned that removing an extension might not remove additional malware installed after someone followed its fake browser-update instructions. It recommended removal and a full antivirus scan.","url":"https://www.kaspersky.com/blog/clickfix-malicious-browser-extensions/56428/","by":"Kaspersky","patch":null},{"at":"2026-09-01","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"PCWorld reported that both Google and Microsoft had removed the extensions from their stores. This was a press report, rather than a platform statement confirming removal or safe replacement versions.","url":"https://www.pcworld.com/article/3224561/19-chrome-extensions-were-secretly-stealing-data-uninstall-these-now.html","by":"PCWorld","patch":null},{"at":"2026-08-30","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"BleepingComputer reported that none of the identified Chrome extensions remained in the Chrome Web Store. It advised affected users to change passwords and move potentially compromised cryptocurrency to new wallets.","url":"https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/","by":"BleepingComputer","patch":null},{"at":"2026-08-27","added":"2026-11-03T21:25:43.261Z","kind":"disclosed","text":"Socket identified 18 malicious Chrome extensions and one Edge extension, including five bought from legitimate developers. The main Chrome extension had been removed; its Edge counterpart remained available and had been reported to Microsoft.","url":"https://www.socket.dev/blog/chrome-edge-extension-wallet-drainer","by":"Socket","patch":"none"},{"at":"2026-08-14","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"The malicious Edge extension received an update changing its command server after its Chrome counterpart was identified as malware, according to Socket.","url":"https://www.socket.dev/blog/chrome-edge-extension-wallet-drainer","by":"Socket","patch":null}],"url":"https://hard.fyi/live/superior-chrome-edge-extensions-aug-2026/","json":"https://hard.fyi/api/live?id=superior-chrome-edge-extensions-aug-2026"}