Chrome and Edge Extensions Strip CSP and Inject JavaScript to Drain EVM, Solana and Tron Wallets

Research identified 19 malicious browser extensions 18 for Google Chrome and 1 for Microsoft Edge that use a modular malware framework to strip website Content Security Policy protections, inject attacker-controlled JavaScript.

Socket determined that 14 extensions were created by the threat actor, while five were acquired from legitimate developers and subsequently weaponized.

The most consequential example is “Enable Right Click & Copy Smart Unlock + OCR,” which was initially developed by PreppHint and later acquired by the actor.

The identified set includes SEO tools, crypto-price trackers, screen-search utilities, ad-spying tools, and right-click enablers.

The malicious update was introduced when the extension had roughly 70,000 users. A related Edge version, “Allow Copy – Select & Enable Right Click,” had approximately 10,000 users, creating an estimated exposure surface of up to 80,000 installations.

Socket said Chrome removed the malicious Chrome listing, but the Edge version remained active when the research was published and had received a new C2 domain in an August 14, 2026 update.

The malicious extensions use background service workers to establish encrypted WebSocket channels with command-and-control infrastructure.

Each installation receives a UUID, while downloaded JavaScript modules are encrypted with AES-GCM using a key derived from the extension ID and installation UUID.

The framework maintains a heartbeat connection, typically every five minutes, and can accept C2 rotation instructions. This gives operators the ability to move victims between backend servers, segment infrastructure, and assign distinct data-exfiltration endpoints per victim.

The payload architecture is especially concerning because the extensions can download new modules after installation, allowing the threat actor to change objectives without publishing a visibly suspicious static package update.

This operational model echoes earlier research from DomainTools, which documented malicious Chrome extensions dating to February 2024.

Combined legitimate-looking functionality with remote code retrieval, arbitrary script execution, broad browser permissions, and persistent backend communications.

DomainTools also observed DOM event-handler techniques designed to bypass or weaken CSP controls.

Malicious browser extensions, tracked by Socket as “Superior,” relies on seemingly legitimate utility extensions that initially provide their advertised functionality before later updates introduce malicious code.

Chrome and Edge Extensions

On startup, the malicious service worker creates dynamic declarativeNetRequest rules that remove Content-Security-Policy, Content-Security-Policy-Report-Only, X-WebKit-CSP, and X-Content-Security-Policy response headers across main frames, subframes, and XMLHttpRequests.

CSP ordinarily constrains which scripts and resources a website can load, helping mitigate cross-site scripting and content injection. By removing it, the extension clears a path for attacker-provided code to execute in targeted websites.

The malware then uses content scripts and Chrome extension APIs to retrieve encrypted modules from chrome.storage.local.

Newer samples dynamically inject scripts through chrome.scripting.executeScript, reducing the visibility associated with static wildcard content-script declarations.

To cross into the webpage’s main execution world, the extensions create hidden DOM objects such as <input>, <img>, or <form> elements, attach malicious event handlers, fire events programmatically, and immediately remove the artifacts.

The approach gives injected code access to the same DOM context as the victim site’s own JavaScript.

Socket observed 16 modules, led by a multi-chain wallet drainer that detects EVM, Solana, and Tron wallets.

The payload fetches chain-specific second-stage code from domains including cookie-whitelist[.]top and whale-alert[.]art, then hijacks legitimate “Connect Wallet” and “Swap” controls.

By cloning buttons, removing original handlers, and attaching malicious handlers, the operators can steer victims through connection and approval flows that authorize asset theft.

Other modules impersonate Ledger and Trezor recovery workflows using pixel-perfect DOM takeovers and fake update pages served from ggle-analytics[.]com.

Victims are prompted to provide 12-, 18-, or 24-word recovery phrases, enabling full wallet compromise.

The toolkit also targets authenticated sessions at Binance, Coinbase, Kraken, KuCoin, OKX, MEXC, Bybit, and MetaMask.

Modules were observed harvesting cookies, bearer tokens, account data, balances, browser history, social-media tokens, and credentials entered into web forms.

A ClickFix-style fake-update module can copy attacker-supplied commands to the clipboard and instruct victims to execute them locally.

The campaign demonstrates why extension trust cannot be treated as permanent.

Chrome checks for extension updates at startup and periodically every few hours, installing them once an extension is idle. That default mechanism can rapidly distribute a malicious update to an established user base.

Organizations should inventory browser extensions, restrict installations to approved publishers, monitor ownership and permission changes, and investigate extensions requesting broad host permissions or the ability to modify network headers.

Users should immediately remove the identified extension IDs and rotate wallet credentials or recovery phrases if they entered them into a suspicious browser prompt.

IOCs

#	Domain
1	active-enable-right-click[.]top
2	api[.]enable-right-click[.]click
3	enable-right-click[.]click
4	payload[.]siteinsight[.]bond
5	api[.]extensionanalyticspro[.]top
6	password-protect-pdf[.]com
7	privatecryptonewsreader[.]pro
8	cryptoratesfiatconverter[.]pro
9	cryptopricebadgequickglance[.]pro

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide