Cluster of 19 Chrome and Edge extensions steal wallets and drain crypto

Researchers at Socket found a coordinated cluster of nineteen browser extensions, eighteen for Chrome and one for Edge, published over the past six months with code to steal cryptocurrency wallet secrets, drain funds, harvest credentials, and inject code into targeted websites. The extensions share code and tradecraft, suggesting a single campaign that may have run even longer. Because a browser extension can read and alter the pages a user visits, a malicious one that reaches a crypto user can quietly capture recovery phrases or redirect transactions. This continues a steady pattern of wallet-draining extensions slipping into official browser stores under the guise of useful tools.

Check

Review the browser extensions installed across your users, remove unknown or wallet-related ones from this cluster, and remind crypto users that a single malicious extension can drain their funds.

Affected

Users who installed any of the nineteen malicious Chrome or Edge extensions, especially cryptocurrency holders; the extensions steal wallet secrets, drain funds, harvest credentials, and can tamper with the websites users visit.

Fix

Restrict extension installation through browser policy, allowlist trusted publishers, audit installed extensions periodically, keep crypto wallets off browsers used for general browsing, and treat any exposed wallet as compromised.