19 extensions went bad after you installed them

The browser extension your bookkeeper installed two years ago passed every review it was given. It did what it advertised. Then someone bought it. Socket published research on August 28 documenting 19 malicious browser extensions — 18 Chrome, one Edge — that harvested crypto wallets, session cookies, and login credentials, and the delivery mechanism was patience, not a clever exploit.

What actually happened

Socket tracks the campaign as Superior and dates it to February 2024, which makes it roughly two and a half years of continuous operation. Of the 19 extensions, the threat actor built 14 and purchased 5 from their previous owners.

The purchased ones are the problem. Socket's write-up describes the pattern plainly: ship a clean first version that does exactly what the listing says, accumulate installs and reviews, then push an update that adds the payload. Every signal a normal person uses to judge an extension — install count, star rating, age, "it has worked fine for years" — is a signal the attacker deliberately farmed.

The biggest catch, "Enable Right Click & Copy — Smart Unlock + OCR," had roughly 80,000 installs across both stores.

What the payload took goes well past crypto. Socket documents harvesting of cookies, bearer tokens, and session material; browser history; form inputs across all sites; exchange account data from Binance, Coinbase, Kraken, and OKX; hardware wallet recovery phrases via a phishing overlay; and Facebook and LinkedIn access tokens. Related activity was documented by DomainTools Investigations back in May 2025.

Google pulled the Chrome version. As of Socket's publication the Edge extension was still live, running updated command-and-control domains stood up after the Chrome takedown.

Why extension permissions are a business risk, not an IT preference

A session token lifted from a browser is a login that skips your MFA. If a member of your team is signed into your Shopify admin, your payment processor, your ad accounts, or your CRM, an extension with broad host permissions can read those sessions from inside the browser. It does not need their password and it does not trip a login alert.

Three things worth doing this week, none of which need a security budget:

Inventory what is installed. On managed Chrome or Edge, pull the extension list from your admin console. On unmanaged machines, chrome://extensions and a screenshot in a group chat is a legitimate audit. You are looking for anything nobody can explain.

Set an allowlist for the accounts that matter. Chrome and Edge enterprise policy both support blocking extensions by default and permitting specific IDs. If a browser touches your payments or admin console, it should not be able to install anything it wants.

Separate the browser profile from the money. The cheapest control here is a dedicated profile — or a dedicated browser — for banking, payment processing, and store admin, with zero extensions in it. Ownership changes silently; blast radius does not have to.

Extension ownership transfers are invisible by design. Treat every installed extension as code from an author who may change without telling you.

Sources: Socket — 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads, The Hacker News.