Attackers acquired previously legitimate browser extensions from their original publishers and transformed them into malware, potentially reaching users who installed the software when it was still safe, researchers at Socket have found. The campaign affected 19 extensions for Google Chrome and Microsoft Edge, with five originally developed by legitimate publishers before being acquired by the attackers. The findings expose a security problem that's tough for users and companies to catch: an extension that looks safe at install can change after an ownership transfer or update, while existing users have little reason to revisit an earlier trust decision.
One extension analyzed by Socket, called Enable Right Click & Copy — Smart Unlock + OCR, had roughly 70,000 users when the malicious code was introduced, while a related Edge extension had about 10,000 users. The extension had originally been built by PreppHint before the threat actor acquired it. Socket said those figures indicate the malware's possible reach rather than confirming every user received an infected version. Once installed, the malware could contact attacker-controlled infrastructure and receive additional JavaScript payloads. Socket discovered it could strip Content Security Policy headers from websites opened in the browser, allowing attacker-supplied code to run inside pages the user visited. The campaign focused heavily on cryptocurrency theft but went further, with Socket observing code that captured information typed into web forms and extracted authentication material from active browser sessions. Other modules targeted logged-in social media accounts and collected browser history.
According to the researchers, the campaign shows why companies can no longer treat approval of a browser extension as a one-time security decision. Keith Prabhu, founder and CEO of Confidis, said organizations should shift "from 'install approval' to 'lifecycle assurance' for browser extensions." The malware's design allowed attackers to change the payloads delivered to infected browsers over time, the researchers noted. Socket linked the extensions to a broader operation dating to February 2024 based on similarities with activity previously documented by DomainTools. Jonathan Ong, senior analyst for managed security services at Omdia, compared the tactic to attacks involving malicious mobile applications, where a clean initial version gains approval before harmful code arrives in a later update.
The attack exposes a visibility gap for enterprise security teams, since tools already deployed across endpoints and networks may detect parts of an attack without seeing what a malicious extension is doing inside the browser. Prabhu noted that "EDR, SWG, SASE, and managed browsers are valuable, but none of these controls, by themselves, provide reliable visibility into extension-level DOM access, CSP tampering, script injection, or token capture." That gap makes browser telemetry more important in environments where employees rely heavily on extensions, particularly when malicious behavior occurs inside authenticated sessions rather than through a conventional executable on the endpoint. The risk is compounded by Chrome's automatic extension update process, which means malicious code added to a later release can reach users without requiring them to download another application or reinstall the extension.
Prabhu recommended determining when the malicious version was present on affected systems, revoking active sessions and refresh tokens, and rotating credentials or other secrets that may have been exposed. Security teams should restrict extension access to sensitive corporate sites and monitor the network connections and data activity extensions generate, he said. Incident responders should examine browser, network, identity, and SaaS logs for signs of account misuse or unauthorized data access. Ong added that MDR services could help close the visibility gap by incorporating browser telemetry into their monitoring, allowing defenders to look for unusual extension behavior such as attempts to remove CSP protections or establish WebSocket connections with previously untrusted domains. The shift from one-time approval to continuous monitoring reflects a broader challenge: marketplaces can vet initial versions, but ownership changes and updates can introduce risk long after installation, turning trusted productivity tools into supply-chain threats. Extensions that employees rely on daily may require the same ongoing scrutiny as any other third-party software with deep access to corporate data and credentials.