19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

Researchers uncovered a campaign (tracked as "Superior") that published or acquired 18 Chrome and 1 Edge extensions which, after benign initial versions, were updated to include malicious modules for multi-chain wallet draining, seed-phrase harvesting, credential and account exfiltration, and social-engineering lures; the extensions remove CSP headers, support persistent/dynamic C2 via WebSocket, and have an install base that includes an extension with ~80,000 users, indicating broad impact and ongoing active exploitation since at least February 2024.