19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

Ravie LakshmananAug 28, 2026Web Security / Supply Chain

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities.

The extensions, per Socket security researcher Karlo Zanki, share similarities in code and tradecraft, with evidence indicating that the campaign may have been active since February 2024. Socket is tracking the activity under the name Superior.

The modus operandi is relatively straightforward: the threat actor either acquires legitimate extensions with proper functionality or pushes a clean version that's devoid of any malware. Once the extensions begin to gather user downloads, a new version with the malicious behavior is published.

Of the identified extensions, 14 were created by the threat actor, while the remaining five were purchased from their previous owners. The complete list of extensions is below -

• Extensions bought by the threat actor
• koccklolohdacbfooifnpebakpbeipc - Enable Right Click & Copy — Smart Unlock + OCR
• fegckejpfnlmfgkfjpinlbgmeeijjkel - RapidLens - Google Lens for Screen Search & Images
• kdenlnncndfnhkognokgfpabgkgehodd - QuickLens - Search Screen with Google Lens
• jamminefolhgepgihbmcjjhgldbfcikp - Password Protect PDF
• inmkjedjdhgpknjogbjomhnbgdccckkg - Allow Copy - Select & Enable Right Click (Microsoft Edge)
• Extensions created and published by the threat actor -
• fcgdejjichpgfaaafflplhfijcnieopb - PixelCheck
• cfpnjdbpojpcongfaefcamjbaolpelcd - Creative Library - Ad Spy Tool
• aapdalkmclfaahehnmicbglkohkldhne - Website Traffic Checker: MirrorSphere SEO Stats
• dkdadldmiefjldmegbjbnhhfddnkhlhm - Site Signal - Website Traffic & SEO Checker
• fjmlhlkccegopebcllcmafahkmeejpph - SEO Pulse Pro - Website Traffic & SEO Analyzer
• iekoapohahgmogbagegmcgplbkikcgke - Private Crypto News Reader
• ahpnnnjbnfbhoikhohglpohnoocjcoco - Blockfolio: Address Monitor
• oeacadlaclegkkkdehjmiifnjhcekclj - Crypto Rates & Fiat Converter
• jmlgannjlbliikgcaieomgmcnfplglea - Crypto Alerter: Price Alarms & Volatility Warnings
• lhmcajhgadanidbopgaoobjlldegjmke - DeFi Pulse Tracker
• gfackggoapepdmnjnkblogdcjpgcjiak - Crypto Price Badge: Quick Glance
• hfijkbdkpidafdbeebnnkhfccildbcle - Multi-Chain Explorer
• cngchfbfgejllcbhmeadjhiebebiome - LedgerLook: Wallet Checker
• aodkjdeghbjiaienipfjkbpcikkacbcp - Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Ray