Posted on

Superior Campaign – Malicious Chrome and Edge Extensions Stealing Credentials, Sessions, and Wallet Data

Threat Overview

Socket disclosed a campaign on August 27, 2026 involving 18 malicious Chrome extensions and one Microsoft Edge extension sharing an extensible malware framework. Five were legitimate products later acquired and weaponized through automatic updates; 14 were threat-actor-created and initially behaved normally before malicious updates. Socket observed persistent WebSocket command-and-control, dynamic C2 rotation, encrypted JavaScript-module delivery, Content Security Policy stripping, page injection, credential/form capture, browser-history theft, session/token theft, wallet draining, hardware-wallet seed-phrase phishing, and ClickFix-style fake browser-update lures. The largest acquired extension had roughly 70,000 Chrome users and a related Edge extension roughly 10,000; this is potential exposure, not a confirmed victim count.

References

Impacted Systems

  • Products: Google Chrome and Microsoft Edge.
  • Platform: endpoints where one of the 19 identified extension IDs was installed and updated to a malicious version.
  • Deployment: user-installed or centrally deployed browser extensions; previously legitimate extensions can become malicious after ownership transfer and auto-update.
  • Attacker prerequisite: malicious extension installation/update and browser execution.
  • Exposure: authenticated browser sessions, credentials, tokens, form data, browsing history, social accounts, cryptocurrency exchanges, and wallets.
  • Store status: Socket reported the Chrome version of the largest extension removed while its Edge counterpart remained active at research time; store removal does not remove already-installed copies.

Why this matters

The campaign has direct identity and endpoint relevance because extensions execute inside authenticated browser sessions and can steal credentials or tokens without a traditional executable payload. The acquired-extension technique also defeats the assumption that a previously trusted extension remains trustworthy.

Exploitation Status

Confirmed malicious campaign. Socket directly analyzed malicious extension code and C2 behavior. This is not a vulnerability exploitation claim. Reported install counts are potential exposure counts, not confirmed compromise counts.

What this hunt looks for

Confirmed campaign domains, known malicious extension IDs on disk or in browser-policy registry paths, browser-to-shell execution associated with ClickFix, rare browser destinations, and process-to-network follow-on activity.

Required logs

  • Microsoft Defender endpoint process, file, registry, and network telemetry in Sentinel.
  • Proxy/firewall URL or hostname visibility in CommonSecurityLog for campaign-domain hunting.
  • Windows SecurityEvent 4688 process creation as a fallback where command line data is available.

First-Pass Hunt – Browser Connections to Confirmed Campaign Infrastructure

let CampaignDomains = dynamic([
    "active-enable-right-click.top",
    "api.enable-right-click.click",
    "enable-right-click.click",
    "payload.siteinsight.bond",
    "api.extensionanalyticspro.top",
    "password-protect-pdf.com",
    "privatecryptonewsreader.pro",
    "cryptoratesfiatconverter.pro",
    "cryptopricebadgequickglance.pro",
    "ws.site-signal.top",
    "content.resonanceweb.top",
    "api.creativelibrary.top",
    "api.codefilearc.net",
    "ws.seopulsepro.sbs",
    "relay.seopulsepro.sbs",
    "defipulsetracker.pro",
    "blockfolioaddressmonitor.pro",
    "pricealarmsvolatilitywarnings.pro",
    "extension.io-safe.icu",
    "feedback.feedx-ray.top",
    "lucky-random.sbs",
    "pipi.saghirmohamed19.workers.dev",
    "mimi.saghirmohamed19.workers.dev",
    "cookie-whitelist.top",
    "whale-alert.art",
    "ggle-analytics.com"
]);
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","chrome","msedge")
| where RemoteUrl in~ (CampaignDomains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
| sort by TimeGenerated asc

Proxy / Firewall Requests to Confirmed Campaign Infrastructure

let CampaignDomains = dynamic([
    "active-enable-right-click.top",
    "api.enable-right-click.click",
    "enable-right-click.click",
    "payload.siteinsight.bond",
    "api.extensionanalyticspro.top",
    "password-protect-pdf.com",
    "privatecryptonewsreader.pro",
    "cryptoratesfiatconverter.pro",
    "cryptopricebadgequickglance.pro",
    "ws.site-signal.top",
    "content.resonanceweb.top",
    "api.creativelibrary.top",
    "api.codefilearc.net",
    "ws.seopulsepro.sbs",
    "relay.seopulsepro.sbs",
    "defipulsetracker.pro",
    "blockfolioaddressmonitor.pro",
    "pricealarmsvolatilitywarnings.pro",
    "extension.io-safe.icu",
    "feedback.feedx-ray.top",
    "lucky-random.sbs",
    "pipi.saghirmohamed19.workers.dev",
    "mimi.saghirmohamed19.workers.dev",
    "cookie-whitelist.top",
    "whale-alert.art",
    "ggle-analytics.com"
]);
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationHostName in~ (CampaignDomains) or RequestURL has_any (CampaignDomains)
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, RequestURL, RequestMethod, DeviceAction, RequestClientApplication, Message
| sort by TimeGenerated asc

Known Malicious Chrome and Edge Extension IDs on Disk

let ExtensionIds = dynamic([
    "pkoccklolohdacbfooifnpebakpbeipc",
    "fegckejpfnlmfgkfjpinlbgmeeijjkel",
    "kdenlnncndfnhkognokgfpabgkgehodd",
    "jamminefolhgepgihbmcjjhgldbfcikp",
    "inmkjedjdhgpknjogbjomhnbgdccckkg",
    "fcgdejjichpgfaaafflplhfijcnieopb",
    "cfpnjdbpojpcongfaefcamjbaolpelcd",
    "aapdalkmclfaahehnmicbglkohkldhne",
    "dkdadldmiefjldmegbjbnhhfddnkhlhm",
    "fjmlhlkccegopebcllcmafahkmeejpph",
    "iekoapohahgmogbagegmcgplbkikcgke",
    "ahpnnnjbnfbhoikhohglpohnoocjcoco",
    "oeacadlaclegkkkdehjmiifnjhcekclj",
    "jmlgannjlbliikgcaieomgmcnfplglea",
    "lhmcajhgadanidbopgaoobjlldegjmke",
    "gfackggoapepdmnjnkblogdcjpgcjiak",
    "hfijkbdkpidafdbeebnnkhfccildbcle",
    "pcngchfbfgejllcbhmeadjhiebebiome",
    "aodkjdeghbjiaienipfjkbpcikkacbcp"
]);
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath has_any (@"\Google\Chrome\User Data\", @"\Microsoft\Edge\User Data\")
| where FolderPath has @"\Extensions\"
| where FolderPath has_any (ExtensionIds)
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Known Malicious Extension IDs in Browser Policy Registry Paths

let ExtensionIds = dynamic([
    "pkoccklolohdacbfooifnpebakpbeipc",
    "fegckejpfnlmfgkfjpinlbgmeeijjkel",
    "kdenlnncndfnhkognokgfpabgkgehodd",
    "jamminefolhgepgihbmcjjhgldbfcikp",
    "inmkjedjdhgpknjogbjomhnbgdccckkg",
    "fcgdejjichpgfaaafflplhfijcnieopb",
    "cfpnjdbpojpcongfaefcamjbaolpelcd",
    "aapdalkmclfaahehnmicbglkohkldhne",
    "dkdadldmiefjldmegbjbnhhfddnkhlhm",
    "fjmlhlkccegopebcllcmafahkmeejpph",
    "iekoapohahgmogbagegmcgplbkikcgke",
    "ahpnnnjbnfbhoikhohglpohnoocjcoco",
    "oeacadlaclegkkkdehjmiifnjhcekclj",
    "jmlgannjlbliikgcaieomgmcnfplglea",
    "lhmcajhgadanidbopgaoobjlldegjmke",
    "gfackggoapepdmnjnkblogdcjpgcjiak",
    "hfijkbdkpidafdbeebnnkhfccildbcle",
    "pcngchfbfgejllcbhmeadjhiebebiome",
    "aodkjdeghbjiaienipfjkbpcikkacbcp"
]);
DeviceRegistryEvents
| where TimeGenerated >= ago(30d)
| where RegistryKey has_any (@"\Google\Chrome\Extensions", @"\Google\Chrome\ExtensionInstallForcelist", @"\Microsoft\Edge\Extensions", @"\Microsoft\Edge\ExtensionInstallForcelist")
| where RegistryValueData has_any (ExtensionIds) or RegistryKey has_any (ExtensionIds) or RegistryValueName has_any (ExtensionIds)
| project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Browser-Spawning Shells or Script Interpreters – ClickFix Follow-On

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe")
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","curl.exe","bitsadmin.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

SecurityEvent 4688 Fallback – Browser-to-Shell Execution

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where ParentProcessName has_any ("chrome.exe","msedge.exe")
| where NewProcessName has_any ("powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| sort by TimeGenerated asc

Rare New Domains Contacted by Chrome or Edge

let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe")
| where isnotempty(RemoteUrl)
| summarize by DeviceId, RemoteUrl;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe")
| where isnotempty(RemoteUrl)
| join kind=leftanti Baseline on DeviceId, RemoteUrl
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteIPs=make_set(RemoteIP,20) by DeviceName, InitiatingProcessAccountName, RemoteUrl
| where Connections >= 3
| sort by LastSeen desc

Process-to-Network Correlation After Browser-Launched Shell

let BrowserShells = DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe")
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe")
| project DeviceId, ProcessTime=TimeGenerated, DeviceName, ChildProcess=FileName, ChildCommandLine=ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| join kind=inner BrowserShells on DeviceId
| where TimeGenerated between (ProcessTime .. ProcessTime + 10m)
| project ProcessTime, TimeGenerated, DeviceName, ChildProcess, ChildCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by ProcessTime asc

Detection Notes

  • Confirmed domain and extension-ID matches are highest signal.
  • Domain-only detections can become stale because Socket observed C2 rotation; no domain match does not prove an extension is clean.
  • File-system detection depends on endpoint visibility into Chrome/Edge user-data paths.
  • Registry policy hunting identifies centrally configured or policy-recorded extensions; normally user-installed extensions may not appear there.
  • Browser-to-shell hunts cover the reported ClickFix capability but will not detect theft that remains entirely inside the browser process.
  • Device* tables require Defender endpoint telemetry; CommonSecurityLog requires proxy/firewall hostname or URL visibility; SecurityEvent fallback requires process-creation auditing.

Leave a comment