Full Report
Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share similarities in code and tradecraft, with evidence indicating that the campaign may have been active
Analysis Summary
# Tool/Technique: Superior (Malicious Browser Extension Campaign)
## Overview
Superior is a coordinated campaign involving a cluster of 19 malicious browser extensions (18 for Google Chrome and one for Microsoft Edge). These extensions use a "dual-functionality" model, providing legitimate features (like SEO tools, PDF protection, or screen searching) while harboring hidden capabilities to steal cryptocurrency wallet secrets, drain digital assets, and execute arbitrary code. The threat actor behind this campaign either creates new extensions or acquires existing ones with established user bases to push malicious updates.
## Technical Details
- **Type:** Malware / Malicious Browser Extensions (Wallet Drainer)
- **Platform:** Windows, macOS, Linux (any OS running Chromium-based browsers like Chrome and Edge)
- **Capabilities:** Credential theft, cryptocurrency draining, arbitrary code execution, C2 communication via WebSockets, and data exfiltration.
- **First Seen:** February 2024
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise] (Via fake websites masquerading as legitimate services)
- [T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain] (Acquiring legitimate extensions to push malicious updates)
- **[TA0003 - Persistence]**
- [T1176 - Browser Extensions]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
- [T1071.001 - Application Layer Protocol: WebSockets]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Dual Functionality:** The extensions provide the promised utility (e.g., "Enable Right Click" or "SEO Pulse Pro") to avoid suspicion while running malicious scripts in the background.
- **Wallet Stealing:** Specifically designed to harvest secret recovery phrases, private keys, and sensitive data from cryptocurrency wallet browser extensions.
- **C2 Persistence:** Establishes a persistent WebSocket connection to a command-and-control server to receive real-time instructions.
### Advanced Features
- **Dynamic C2 Rotation:** The loading framework can change its C2 endpoint based on instructions from the initial server, allowing the actor to distribute victims across different infrastructure to evade detection.
- **Per-Victim Exfiltration:** Data exfiltration endpoints are received dynamically, allowing for unique channels for each victim.
- **Arbitrary Code Injection:** The ability to fetch and execute remote JavaScript code within the context of the user's browser.
## Indicators of Compromise
### Extension IDs (Chrome/Edge Store)
- `koccklolohdacbfooifnpebakpbeipc` (Enable Right Click & Copy)
- `fegckejpfnlmfgkfjpinlbgmeeijjkel` (RapidLens)
- `kdenlnncndfnhkognokgfpabgkgehodd` (QuickLens)
- `jamminefolhgepgihbmcjjhgldbfcikp` (Password Protect PDF)
- `inmkjedjdhgpknjogbjomhnbgdccckkg` (Allow Copy - Edge)
- `fcgdejjichpgfaaafflplhfijcnieopb` (PixelCheck)
- `cfpnjdbpojpcongfaefcamjbaolpelcd` (Creative Library)
- `aapdalkmclfaahehnmicbglkohkldhne` (Website Traffic Checker)
- `dkdadldmiefjldmegbjbnhhfddnkhlhm` (Site Signal)
- `fjmlhlkccegopebcllcmafahkmeejpph` (SEO Pulse Pro)
- `iekoapohahgmogbagegmcgplbkikcgke` (Private Crypto News Reader)
- `ahpnnnjbnfbhoikhohglpohnoocjcoco` (Blockfolio: Address Monitor)
- `oeacadlaclegkkkdehjmiifnjhcekclj` (Crypto Rates)
- `jmlgannjlbliikgcaieomgmcnfplglea` (Crypto Alerter)
- `lhmcajhgadanidbopgaoobjlldegjmke` (DeFi Pulse Tracker)
- `gfackggoapepdmnjnkblogdcjpgcjiak` (Crypto Price Badge)
- `hfijkbdkpidafdbeebnnkhfccildbcle` (Multi-Chain Explorer)
- `cngchfbfgejllcbhmeadjhiebebiome` (LedgerLook)
- `aodkjdeghbjiaienipfjkbpcikkacbcp` (Meta & Facebook Ad Library Spy)
### Network Indicators (Defanged)
- `socket[.]dev/blog/chrome-edge-extension-wallet-drainer` (Research Source)
- *Note: Specific C2 domains were rotated dynamically; monitoring for unusual WebSocket traffic from browser extensions is recommended.*
## Associated Threat Actors
- **Superior:** The name assigned by Socket researchers to track this specific cluster of activity.
## Detection Methods
- **Behavioral Detection:** Monitor for browser extensions initiating WebSocket connections to unrecognized domains or extensions requesting excessive permissions (e.g., `webRequest`, `storage`, or access to all URLs).
- **Extension Auditing:** Cross-reference installed extension IDs against the list of known malicious IDs provided by researchers.
- **Traffic Analysis:** Detect unusual outbound traffic originating from browser processes directed toward known crypto-draining infrastructure.
## Mitigation Strategies
- **Prevention:** Users should be wary of extensions that request broad permissions or have been recently updated after a long period of inactivity.
- **Enterprise Hardening:** Implement a browser extension allowlist (or blocklist) via Group Policy (GPO) or MDM to prevent the installation of unapproved extensions.
- **Inventory Management:** Regularly audit installed extensions across the organization's fleet.
- **Crypto Security:** Use hardware wallets instead of software-based browser extension wallets for significant asset holdings.
## Related Tools/Techniques
- **Wallet Drainers:** Similar to Inferno Drainer or MS Drainer services.
- **Bait-and-Switch Updates:** A common technique where a clean app is updated with a malicious payload once a reputation is established.