Superior malware in 19 Chrome and Edge extensions targets wallets and passwords
Nineteen Chrome and Edge extensions carried Superior malware targeting passwords, browsing data and cryptocurrency. Remove the listed extensions, scan the computer and change exposed passwords. No verified safe replacement releases were identified.
Remove every listed extension you find in Chrome or Edge's extension manager and run a full antivirus scan. If you used an affected browser, change potentially exposed passwords from a clean device; if a wallet or recovery phrase may have been exposed, move the assets to a newly created wallet using a clean device. If you followed a fake update's instructions, ask a trusted IT professional to check for malware beyond the browser.
- Enable Right Click & Copy — Smart Unlock + OCRno fixed version yet
- RapidLens - Google Lens for Screen Search & Imagesno fixed version yet
- QuickLens - Search Screen with Google Lensno fixed version yet
- Password Protect PDFno fixed version yet
- Allow Copy - Select & Enable Right Clickno fixed version yet
- PixelCheckno fixed version yet
- Creative Library - Ad Spy Toolno fixed version yet
- Website Traffic Checker: MirrorSphere SEO Statsno fixed version yet
- Site Signal - Website Traffic & SEO Checkerno fixed version yet
- SEO Pulse Pro - Website Traffic & SEO Analyzerno fixed version yet
- Private Crypto News Readerno fixed version yet
- Blockfolio: Address Monitorno fixed version yet
- Crypto Rates & Fiat Converterno fixed version yet
- Crypto Alerter: Price Alarms & Volatility Warningsno fixed version yet
- DeFi Pulse Trackerno fixed version yet
- Crypto Price Badge: Quick Glanceno fixed version yet
- Multi-Chain Explorerno fixed version yet
- LedgerLook: Wallet Checkerno fixed version yet
- Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Rayno fixed version yet
What’s happening
Socket disclosed 19 malicious Chrome and Edge extensions carrying Superior malware on 27 August. Five had been bought from legitimate developers before being poisoned; the others initially appeared harmless too. Chrome automatically updates extensions, allowing malicious releases to reach existing users. One acquired utility had about 70,000 Chrome users and 10,000 Edge users: potential exposure, not confirmed infections. Observed payloads targeted passwords, account sessions, browsing history and cryptocurrency, including recovery phrases through fake Ledger and Trezor pages. Socket linked the operation to activity dating back to February 2024. PCWorld reported removal from both stores on 1 September, but no Google or Microsoft incident statement confirming complete removal was found. By 3 November, Socket still labelled the broader campaign ongoing, with activity last recorded on 21 September. Affected release numbers and verified safe replacement versions were not established. The reviewed sources provide no confirmed victim total, total losses or recovery outcome.
- What
- Poisoned software
- Affects
- 19 Google Chrome and Microsoft Edge browser extensions
- Affected
- Chrome: Enable Right Click & Copy — Smart Unlock + OCR
Chrome: RapidLens - Google Lens for Screen Search & Images
Chrome: QuickLens - Search Screen with Google Lens
Chrome: Password Protect PDF
Edge: Allow Copy - Select & Enable Right Click
Chrome: PixelCheck
Chrome: Creative Library - Ad Spy Tool
Chrome: Website Traffic Checker: MirrorSphere SEO Stats
Chrome: Site Signal - Website Traffic & SEO Checker
Chrome: SEO Pulse Pro - Website Traffic & SEO Analyzer
Chrome: Private Crypto News Reader
Chrome: Blockfolio: Address Monitor
Chrome: Crypto Rates & Fiat Converter
Chrome: Crypto Alerter: Price Alarms & Volatility Warnings
Chrome: DeFi Pulse Tracker
Chrome: Crypto Price Badge: Quick Glance
Chrome: Multi-Chain Explorer
Chrome: LedgerLook: Wallet Checker
Chrome: Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Ray - Fixed in
- No fix yet
- Since
- 27 Aug 2026
- Closed
- 21 Sept 2026
Timeline
- Update
Socket's broader Superior tracker records this as its latest activity date and lists 23 unique packages. Checked on 3 November, the tracker still describes the campaign as ongoing.
- Update
Kaspersky warned that removing an extension might not remove additional malware installed after someone followed its fake browser-update instructions. It recommended removal and a full antivirus scan.
- Update
PCWorld reported that both Google and Microsoft had removed the extensions from their stores. This was a press report, rather than a platform statement confirming removal or safe replacement versions.
- Update
BleepingComputer reported that none of the identified Chrome extensions remained in the Chrome Web Store. It advised affected users to change passwords and move potentially compromised cryptocurrency to new wallets.
- Made publicNo fix yet
Socket identified 18 malicious Chrome extensions and one Edge extension, including five bought from legitimate developers. The main Chrome extension had been removed; its Edge counterpart remained available and had been reported to Microsoft.
- Update
The malicious Edge extension received an update changing its command server after its Chrome counterpart was identified as malware, according to Socket.
Sources
- 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing PayloadsSocket · 27 Aug 2026
- The Chrome Extension update lifecycleGoogle · 8 Sept 2025
- Chrome Web Store extensions caught stealing crypto, browser dataBleepingComputer · 30 Aug 2026
- 19 Chrome extensions were secretly stealing data. Uninstall these nowPCWorld · 1 Sept 2026
- Malicious Chrome and Edge add-ons and ClickFix attacksKaspersky · 17 Sept 2026
- Superior campaign tracker — checked 3 November 2026Socket · 3 Nov 2026