9 minhigh
19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads
Socket researchers identified 19 malicious Chrome and Edge extensions delivering a modular malware framework focused on cryptocurrency wallet draining and credential theft. The extensions establish WebSocket C2 channels, strip CSP headers, and inject malicious JavaScript modules into visited web pages. The threat actor acquires legitimate extensions with existing user bases and weaponizes them via auto-updates, potentially impacting up to 80,000 users for a single extension.
Sens:■ ImmediateConf:
Showing defanged values
- domainactive-enable-right-click[.]topPrimary C2 domain for the 'Enable Right Click & Copy' extension malware
- domainapi[.]codefilearc[.]netC2 domain
- domainapi[.]creativelibrary[.]topC2 domain
- domainapi[.]enable-right-click[.]clickC2 domain for Enable Right Click extension
- domainapi[.]extensionanalyticspro[.]topC2 domain
- domainblockfolioaddressmonitor[.]proC2 domain
- domaincontent[.]resonanceweb[.]topC2 domain
- domaincookie-whitelist[.]topHosting domain for wallet drainer scripts (multi-chain)
- domaincryptopricebadgequickglance[.]proC2 domain
- domaincryptoratesfiatconverter[.]proC2 domain
- domaindefipulsetracker[.]proC2 domain
- domainenable-right-click[.]clickC2 domain for Enable Right Click extension
- domainextension[.]io-safe[.]icuC2 domain
- domainfeedback[.]feedx-ray[.]topC2 domain
- domainggle-analytics[.]comHosting domain for fake Ledger/Trezor phishing pages and fake browser update lures
- domainlucky-random[.]sbsSecondary C2 domain
- domainmimi[.]saghirmohamed19[.]workers[.]devCloudflare Worker used as data exfiltration sink
- domainpassword-protect-pdf[.]comC2 domain
- domainpayload[.]siteinsight[.]bondC2 domain
- domainpipi[.]saghirmohamed19[.]workers[.]devCloudflare Worker used as data exfiltration sink
- domainpricealarmsvolatilitywarnings[.]proC2 domain
- domainprivatecryptonewsreader[.]proC2 domain
- domainrelay[.]seopulsepro[.]sbsC2 domain
- domainwhale-alert[.]artHosting domain for wallet drainer scripts (multi-chain)
- domainws[.]seopulsepro[.]sbsC2 domain (WebSocket endpoint)
- domainws[.]site-signal[.]topC2 domain (WebSocket endpoint)
Detection / Hunteropenrouter
What Happened
Researchers found 19 malicious browser add-ons for Chrome and Edge that steal cryptocurrency wallets and passwords. The attackers bought some of these add-ons from their original creators, then added malicious code that automatically installed on users' computers through the browser's auto-update feature. One add-on had up to 80,000 users potentially exposed. The malicious add-ons remove browser security protections, then inject code into websites you visit to steal wallet passwords, exchange login sessions, and even trick people into typing their hardware wallet recovery phrases into fake pages. Users should review and remove unnecessary browser extensions, especially those related to crypto, SEO tools, or screen search utilities.
Key Takeaways
- 19 malicious browser extensions (18 Chrome, 1 Edge) deliver a modular malware framework focused on cryptocurrency wallet draining and credential theft.
- Threat actors acquired legitimate extensions with existing user bases (e.g., 'Enable Right Click & Copy' with 70,000+ users) and weaponized them via auto-updates.
- The malware strips Content Security Policy (CSP) headers from all visited websites to enable injection of malicious JavaScript modules into the main world execution context.
- C2 communication uses WebSocket with AES-GCM encryption, and supports endpoint rotation to evade detection and takedown.
- Malicious modules include multi-chain wallet drainers, hardware wallet seed phrase phishing, exchange session hijacking, and a universal credential/form grabber.
Affected Systems
- Google Chrome
- Microsoft Edge
- Browser extensions
- Cryptocurrency wallets (EVM, Solana, Tron)
- Hardware wallets (Trezor, Ledger)
- Cryptocurrency exchanges (OKX, MEXC, Kraken, KuCoin, Coinbase, Binance, Bybit)
- MetaMask
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: User installs a legitimate browser extension that is later acquired by the threat actor and updated with malicious code via auto-update.
- C2 Communication: Background service worker establishes a persistent WebSocket connection to C2 server with 5-minute heartbeat, downloading encrypted JavaScript modules stored in chrome.storage.local.
- Defense Evasion: Extension registers declarativeNetRequest rules to strip Content-Security-Policy headers from all visited websites.
- Execution: Content scripts read malicious modules from local storage, create hidden DOM elements with event handlers to execute payloads in the main world execution context.
- Collection & Exfiltration: Modules perform wallet draining, credential harvesting, session hijacking, and seed phrase phishing, exfiltrating data to dynamically assigned endpoints including Cloudflare Workers.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article. The article provides code snippets and IOC lists for manual analysis.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | EDR products have limited visibility into browser extension internal behavior, content script execution in the main world, and chrome.storage API usage. The malicious activity occurs within the browser process context. |
| Network Visibility | Medium | WebSocket connections to C2 domains and data exfiltration to Cloudflare Workers are visible in network telemetry, but traffic is encrypted and C2 endpoints can rotate dynamically. |
| Detection Difficulty | Hard | The malware operates entirely within the browser extension sandbox, uses encrypted WebSocket for C2, strips CSP headers via legitimate extension APIs, and rotates C2 endpoints. Distinguishing malicious extension behavior from legitimate extension behavior requires deep browser telemetry not commonly available. |
Required Log Sources
- Browser extension inventory and audit logs
- DNS resolution logs
- Proxy/NGFW logs for WebSocket traffic
- Endpoint browser telemetry if available
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for browser extensions registering declarativeNetRequest rules that remove Content-Security-Policy or X-Content-Security-Policy response headers across all URLs. | Browser extension telemetry, EDR browser process monitoring, or browser management platform logs | Defense Evasion | Low - legitimate extensions rarely strip CSP headers globally |
| Hunt for persistent WebSocket connections with 5-minute heartbeat intervals originating from browser processes to domains using .top, .sbs, .pro, or .icu TLDs. | Network proxy logs, NGFW logs, DNS logs | Command and Control | Medium - some legitimate browser extensions use WebSocket connections |
| Hunt for browser extensions creating hidden input elements with inline onchange event handlers that are immediately dispatched and removed. | Browser DOM mutation observation, EDR browser script logging if available | Execution | Low - this pattern is unusual for legitimate web applications |
| Hunt for extensions whose chrome.storage.local keys include terms like 'nodes', 'userId', 'deployed', or 'latest-interaction' indicating the malware framework's data structure. | Browser extension storage analysis, endpoint forensic artifacts | Persistence | Low - these specific key names are associated with the identified malware framework |
| Hunt for network traffic to Cloudflare Workers subdomains (workers.dev) from browser processes that also have WebSocket connections to suspicious C2 domains. | DNS logs, proxy logs, NGFW logs | Exfiltration | Medium - Cloudflare Workers are used by legitimate services |
Control Gaps
- Network security controls may not inspect WebSocket traffic effectively
- EDR lacks visibility into browser extension storage and content script execution
- Browser extension allowlisting/denylisting may not catch extensions that were initially clean but later weaponized
- CSP header protection is bypassed by the extension's declarativeNetRequest rules
Key Behavioral Indicators
- Browser extension using chrome.declarativeNetRequest to remove CSP headers from all sites
- WebSocket connection with 25-second ping interval to suspicious domains
- Hidden DOM input elements with inline event handlers created and immediately removed
- chrome.storage.local keys named 'nodes', 'userId', 'deployed', 'lastActive'
- Extension making WebSocket connections with 'uuid' and 'extension' query parameters
False Positive Assessment
Low
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider auditing all browser extensions installed on managed endpoints against the list of 19 identified extension IDs provided in the article.
- If your browser management platform supports it, consider pushing a blocklist update to remove the identified malicious extensions from all managed browsers.
- Consider blocking the identified C2 and exfiltration domains at the network perimeter, particularly the .top, .sbs, .pro, and workers.dev domains listed in the IOCs.
Infrastructure Hardening
- Evaluate whether your web proxy or NGFW can inspect and block WebSocket traffic to suspicious domains, particularly newly registered domains on .top and .sbs TLDs.
- Consider implementing DNS filtering for known malicious domains identified in the campaign.
- If your organization uses a browser enterprise management platform, consider enforcing extension allowlisting rather than permit-by-default.
User Protection
- Consider deploying browser extension monitoring tools that alert on extensions requesting broad permissions like declarativeNetRequest with wildcard URL filters.
- Evaluate whether your endpoint protection can detect CSP header stripping behavior at the browser process level.
- Consider educating users on the risk of browser extension auto-updates and ownership changes, particularly for extensions handling cryptocurrency or credentials.
Security Awareness
- Consider adding guidance to existing security awareness programs about the risk of acquiring legitimate browser extensions by threat actors and weaponizing them via auto-update.
- Where applicable, advise users to regularly review installed browser extensions and remove unnecessary ones, especially those related to crypto, SEO, or screen utilities.
- Consider advising users to verify extension ownership history and be cautious of extensions that change developers or significantly change permissions.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping7 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Domains:
api[.]enable-right-click[.]click- C2 domain for Enable Right Click extensionenable-right-click[.]click- C2 domain for Enable Right Click extensionpayload[.]siteinsight[.]bond- C2 domainapi[.]extensionanalyticspro[.]top- C2 domainpassword-protect-pdf[.]com- C2 domainprivatecryptonewsreader[.]pro- C2 domaincryptoratesfiatconverter[.]pro- C2 domaincryptopricebadgequickglance[.]pro- C2 domainws[.]site-signal[.]top- C2 domain (WebSocket endpoint)content[.]resonanceweb[.]top- C2 domainapi[.]creativelibrary[.]top- C2 domainapi[.]codefilearc[.]net- C2 domainws[.]seopulsepro[.]sbs- C2 domain (WebSocket endpoint)relay[.]seopulsepro[.]sbs- C2 domaindefipulsetracker[.]pro- C2 domainblockfolioaddressmonitor[.]pro- C2 domainpricealarmsvolatilitywarnings[.]pro- C2 domainextension[.]io-safe[.]icu- C2 domainfeedback[.]feedx-ray[.]top- C2 domain
- Other:
pkoccklolohohdacbfooifnpebakpbeipc- Chrome Extension ID: Enable Right Click & Copy — Smart Unlock + OCR (acquired by threat actor, ~70K users)fegckejpfnlmfgkfjpinlbgmeeijjkel- Chrome Extension ID: RapidLens - Google Lens for Screen Search & Images (acquired by threat actor)kdenlnncndfnhkognokgfpabgkgehodd- Chrome Extension ID: QuickLens - Search Screen with Google Lens (acquired by threat actor)jamminefolhgepgihbmcjjhgldbfcikp- Chrome Extension ID: Password Protect PDF (acquired by threat actor)inmkjedjdhgpknjogbjomhnbgdccckkg- Edge Extension ID: Allow Copy - Select & Enable Right Click (acquired by threat actor)fcgdejjichpgfaaafflplhfijcnieopb- Chrome Extension ID: PixelCheck (threat actor created)cfpnjdbpojpcongfaefcamjbaolpelcd- Chrome Extension ID: Creative Library - Ad Spy Tool (threat actor created)aapdalkmclfaahehnmicbglkohkldhne- Chrome Extension ID: Website Traffic Checker: MirrorSphere SEO Stats (threat actor created)dkdadldmiefjldmegbjbnhhfddnkhlhm- Chrome Extension ID: Site Signal - Website Traffic & SEO Checker (threat actor created)fjmlhlkccegopebcllcmafahkmeejpph- Chrome Extension ID: SEO Pulse Pro - Website Traffic & SEO Analyzer (threat actor created)iekoapohahgmogbagegmcgplbkikcgke- Chrome Extension ID: Private Crypto News Reader (threat actor created)ahpnnnjbnfbhoikhohglpohnoocjcoco- Chrome Extension ID: Blockfolio: Address Monitor (threat actor created)oeacadlaclegkkkdehjmiifnjhcekclj- Chrome Extension ID: Crypto Rates & Fiat Converter (threat actor created)jmlgannjlbliikgcaieomgmcnfplglea- Chrome Extension ID: Crypto Alerter: Price Alarms & Volatility Warnings (threat actor created)lhmcajhgadanidbopgaoobjlldegjmke- Chrome Extension ID: DeFi Pulse Tracker (threat actor created)gfackggoapepdmnjnkblogdcjpgcjiak- Chrome Extension ID: Crypto Price Badge: Quick Glance (threat actor created)hfijkbdkpidafdbeebnnkhfccildbcle- Chrome Extension ID: Multi-Chain Explorer (threat actor created)pcngchfbfgejllcbhmeadjhiebebiome- Chrome Extension ID: LedgerLook: Wallet Checker (threat actor created)aodkjdeghbjiaienipfjkbpcikkacbcp- Chrome Extension ID: Meta & Facebook Ad Library Spy (threat actor created)
Related
Stay currentSubscribe via RSS
