Socket says Superior has 19 malicious Chrome and Edge extensions active since February 2024, including 18 Chrome add-ons and one for Microsoft Edge. The actor created 14 of them and bought five, then turned the installed base into the delivery channel by pushing malicious updates through Chrome’s normal auto-update path.
That matters because the extensions can look clean when users first install them, then change behavior later without a new download or click. Socket says the code can steal wallet secrets, drain cryptocurrency, harvest credentials, and inject code into targeted sites, so the danger sits in post-install trust, not just in screening new add-ons.
For Chrome and Edge fleets, the exposure is the existing extension estate: anything already approved or user-installed can become a malware route after publication if its update channel is compromised or abused. The reporting points to a supply-chain style campaign, but leaves the same operational question for defenders: which trusted extensions can still change under their feet.
The findings raise questions over whether existing endpoint and network controls provide enough visibility into malicious activity happening inside the browser.
Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lures.