Malicious Chrome and Edge Extensions Draining Crypto Wallets: Detection, Hunting, and Remediation Guide

Researchers at Socket, led by Karlo Zanki, have identified a coordinated cluster of 18 Google Chrome extensions and one Microsoft Edge extension published to official web stores over the last six months that contain wallet secret-stealing and cryptocurrency-draining code. The extensions share code similarities and tradecraft, indicating a single actor or group is operating a sustained campaign — not a one-off upload. Evidence suggests the campaign has been active and evolving, with new extensions being published to replace ones that get taken down.

This is the modern supply-chain problem in miniature: the official browser extension stores are the delivery mechanism, the victim's own browser is the execution environment, and the target — cryptocurrency wallet seed phrases, private keys, and active sessions — lives directly in the browser context the extension has permission to read. For enterprises, the risk isn't limited to personal crypto losses. The same tradecraft exfiltrates session tokens, credentials, and clipboard contents, which makes these extensions a viable initial-access vector into corporate environments where employees use browser-based wallet tools, password managers, or SSO sessions on the same profile.

If your users can install extensions freely, assume some percentage already have something unwanted installed. This post gives you the hunting, detection, and hardening playbook.

Technical Analysis

Affected Platforms

• Google Chrome — 18 malicious extensions published via the Chrome Web Store
• Microsoft Edge — 1 malicious extension published via the Edge Add-ons store (Edge also runs Chrome Web Store extensions, so Edge users are exposed to the Chrome-listed set as well)
• Any Chromium-based browser permitting sideloaded or store-installed extensions

How the Attack Works (Defender's View)

The tradecraft follows the standard malicious-extension playbook observed across wallet-drainer campaigns:

1. Delivery via official stores. Extensions are published with benign-looking descriptions (utilities, productivity tools, wallet helpers, price trackers). Store review is evaded by shipping clean code initially or by obfuscating the malicious logic.
2. Permission abuse. At install time, the extension requests broad permissions — typically Read and change all your data on all websites, tabs, storage, and clipboardRead/clipboardWrite. These are the keys to the kingdom inside the browser sandbox.
3. Secret harvesting. Content scripts scrape wallet interfaces (MetaMask, Phantom, and web-based wallets), capture seed phrases and private keys during entry, and read extension Local Storage / IndexedDB where wallet data is cached.
4. Draining logic. Once keys are captured, the extension either signs and broadcasts transactions directly (drainer) or exfiltrates secrets to attacker infrastructure — frequently via Telegram bot APIs, disposable domains, or hardcoded C2 endpoints — where automated sweeping scripts empty wallets within minutes.
5. Persistence and rotation. Because the campaign operates as a cluster, when one extension is flagged and removed, a replacement with near-identical code is published under a new name and developer account. Socket's finding of shared code and tradecraft across 19 extensions confirms this whack-a-mole model.

Exploitation Status

This is confirmed in-the-wild activity. The extensions were live in official stores and actively downloadable. There is no CVE associated with this campaign — the browsers are functioning as designed; the weakness is the trust model of the extension ecosystem itself. No CISA KEV entry applies. The relevant MITRE ATT&CK mappings are T1176 (Browser Extensions), T1552 (Unsecured Credentials), T1115 (Clipboard Data), T1041 (Exfiltration Over C2 Channel), and T1557 (Adversary-in-the-Middle) where content scripts tamper with wallet transaction flows.

Why This Matters Beyond Crypto

An extension with all_urls access can read every authenticated page the user loads — including webmail, SaaS consoles, admin panels, and cloud portals. If a drainer operator chooses to harvest session cookies instead of (or in addition to) wallet keys, they gain session-replay access that bypasses MFA. Treat every malicious extension discovery as a potential session compromise event, not just a financial theft event.

Detection & Response

The ground truth for hunting this threat lives in three places: the extension directories on disk (Extensions\<id>\<version>\manifest.json), the network connections made by chrome.exe / msedge.exe, and the registry/preference stores that record installed extension IDs. The detections below target those observables.

Sigma Rules

These rules target the most reliable host-level signals: scripting interpreters or LOLBins spawned by the browser (common in post-compromise activity and extension-facilitated payloads), and sideloaded extensions via developer-mode flags, which bypass store review entirely.

---
title: Browser Process Spawning Scripting Interpreter or LOLBin
id: 3f9c2a71-8b4d-4e6a-91c5-7d2e4f8a1b03
status: experimental
description: Detects Chrome or Edge spawning scripting interpreters or LOLBins. Malicious extensions and drainer post-compromise activity frequently hand off to powershell, wscript, or cmd for payload staging and exfiltration. Browsers do not legitimately spawn these processes in normal operation.
references:
  - https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html
  - https://attack.mitre.org/techniques/T1176/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.execution
  - attack.t1176
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare enterprise browser integrations or SSO plugins that invoke local scripts
  - Browser crash-reporting tooling (verify command line before dismissing)
level: high
---
title: Browser Launched With Developer Extension Sideloading Flag
id: 8d4e1b62-2c7a-4f59-a3d8-6e9b5c1f2a47
status: experimental
description: Detects Chrome or Edge launched with --load-extension, which sideloads unpacked extensions bypassing web store review. Wallet-drainer operators and red teams use this to run unsigned malicious extensions. Has virtually no legitimate use outside developer workstations.
references:
  - https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1176
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_flag:
    CommandLine|contains:
      - '--load-extension'
  condition: selection_image and selection_flag
falsepositives:
  - Extension developers and QA engineers loading unpacked builds
level: high

KQL Hunt — Browser Network and Extension Artifacts (Sentinel / Defender)

This query hunts for browsers making connections to common drainer exfiltration channels (Telegram bot API is the dominant one in wallet-stealer campaigns) and for recently written extension manifests so analysts can enumerate what landed on endpoints in the last six months — the campaign's publication window.

// Hunt 1: Browser processes connecting to known exfiltration channels used by wallet drainers
let BrowserExfil =
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe")
| where RemoteUrl has_any ("api.telegram.org", "t.me", "pastebin.com", "discord.com/api/webhooks")
    or RemoteUrl endswith ".onion.ly"
    or RemoteUrl endswith ".webhook.site"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP;
// Hunt 2: Extension manifests written to disk in the last 180 days (campaign publication window)
let RecentExtensions =
DeviceFileEvents
| where TimeGenerated > ago(180d)
| where FolderPath has "\\Extensions\\" and FileName =~ "manifest.json"
| where FolderPath has_any ("\\Chrome\\", "\\Edge\\")
| project TimeGenerated, DeviceName, FolderPath, InitiatingProcessAccountName
| extend ExtensionId = tostring(split(FolderPath, "\\")[array_length(split(FolderPath, "\\")) - 3])
| summarize FirstManifestWrite = min(TimeGenerated) by DeviceName, ExtensionId, InitiatingProcessAccountName;
// Correlate: devices with recent extensions that ALSO hit exfil channels
BrowserExfil
| join kind=leftouter RecentExtensions on DeviceName
| project DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, Connections, ExtensionId, FirstManifestWrite
| order by FirstManifestWrite asc

Velociraptor VQL — Enumerate Installed Extensions Fleet-Wide

Extension directories are the forensic source of truth. This artifact enumerates every Chrome and Edge extension manifest across user profiles, extracts the extension ID, name, and requested permissions, and flags the dangerous permission combinations (broad site access plus clipboard/storage) that wallet drainers require.

-- Enumerate Chrome/Edge extensions and flag dangerous permission sets (T1176)
LET manifests = SELECT FullPath, mtime() AS InstallTime
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Extensions/*/*/manifest.json',
  'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Extensions/*/*/manifest.json'
])

SELECT FullPath,
       InstallTime,
       split(string=FullPath, sep='\\')[length(list=split(string=FullPath, sep='\\')) - 3] AS ExtensionId,
       read_file(filename=FullPath, length=4096) AS ManifestContent,
       if(condition=read_file(filename=FullPath, length=4096) =~ '<all_urls>'
          AND read_file(filename=FullPath, length=4096) =~ 'clipboard',
          then='HIGH RISK: broad site access + clipboard',
          else=if(condition=read_file(filename=FullPath, length=4096) =~ '<all_urls>',
                  then='REVIEW: broad site access',
                  else='standard')) AS RiskAssessment
FROM manifests
ORDER BY InstallTime DESC

Remediation Script — Audit and Report Installed Extensions

Run this across endpoints (via GPO, Intune, or your RMM) to inventory every installed extension and flag those installed within the campaign window. Compare output against the extension IDs published in the Socket report.

# Enumerate all Chrome and Edge extensions per user profile and flag recent installs
# Run as SYSTEM or admin via RMM/Intune/GPO startup script. Output CSV per host.

$campaignWindowStart = Get-Date "2026-02-01"  # six-month publication window per Socket report
$results = @()

$extPaths = @(
    "C:\Users\*\AppData\Local\Google\Chrome\User Data\*\Extensions",
    "C:\Users\*\AppData\Local\Microsoft\Edge\User Data\*\Extensions"
)

foreach ($basePath in $extPaths) {
    Get-ChildItem -Path $basePath -Directory -ErrorAction SilentlyContinue | ForEach-Object {
        $extId = $_.Name
        Get-ChildItem -Path $_.FullName -Directory -ErrorAction SilentlyContinue | ForEach-Object {
            $manifest = Join-Path $_.FullName "manifest.json"
            if (Test-Path $manifest) {
                $installTime = (Get-Item $_.FullName).CreationTime
                $content = Get-Content $manifest -Raw -ErrorAction SilentlyContinue
                $name = ($content | ConvertFrom-Json -ErrorAction SilentlyContinue).name
                $highRisk = ($content -match 'all_urls') -or ($content -match 'clipboard')
                $results += [PSCustomObject]@{
                    Host        = $env:COMPUTERNAME
                    Profile     = ($basePath -split '\\')[2]
                    Browser     = if ($basePath -match 'Chrome') { 'Chrome' } else { 'Edge' }
                    ExtensionId = $extId
                    Name        = $name
                    Installed   = $installTime
                    HighRiskPerms = $highRisk
                    InCampaignWindow = ($installTime -gt $campaignWindowStart)
                }
            }
        }
    }
}

# Flag anything installed during the campaign window with high-risk permissions
$suspicious = $results | Where-Object { $_.InCampaignWindow -and $_.HighRiskPerms }
$results | Export-Csv -Path "C:\ProgramData\ext_audit_$env:COMPUTERNAME.csv" -NoTypeInformation
if ($suspicious) {
    $suspicious | Format-Table -AutoSize | Out-File "C:\ProgramData\ext_audit_FLAGGED_$env:COMPUTERNAME.txt"
    Write-Output "ALERT: $($suspicious.Count) high-risk extension(s) installed within campaign window. Review flagged output."
} else {
    Write-Output "No high-risk extensions found in campaign window on $env:COMPUTERNAME."
}

Remediation

There is no patch — this is a trust-model and hygiene problem. Remediate in layers:

Immediate (today):

1. Cross-reference against the Socket report. Pull the published extension IDs/names from the Socket disclosure and the linked THN article, then match them against your VQL/PowerShell inventory. Remove any hit via enterprise policy, not just by asking users.
2. Force-remove confirmed-bad extensions via policy. For Chrome, use ExtensionInstallBlocklist (wildcard * to block all, or specific IDs). For Edge, use ExtensionInstallBlocklist under HKLM\SOFTWARE\Policies\Microsoft\Edge. Policy removal kills the extension even for users who can't or won't uninstall.
3. Treat affected users as potentially session-compromised. If a malicious extension was present, rotate credentials and revoke active sessions for accounts accessed in that browser profile — cloud consoles, SaaS, email. The drainer may have harvested more than crypto keys.
4. Notify users to check wallet activity. Anyone who held cryptocurrency in a browser wallet on an affected machine should assume keys are compromised and migrate funds to a new wallet with freshly generated seeds (ideally hardware-backed).

Structural (this quarter):

5. Move to an allowlist extension model. This is the only durable fix. Chrome: ExtensionInstallAllowlist with an explicit, reviewed set of business-justified extensions, plus ExtensionInstallBlocklist: *. Edge: same policy family. Expect pushback; the alternative is re-running this IR cycle every few months.
6. Block developer-mode and sideloading. Set ExtensionSettings to disable developer mode and block --load-extension via policy where feasible.
7. Alert on store-published extension installs. Feed the manifest-write KQL hunt above into Sentinel as a scheduled rule; new extension installs on managed endpoints should be a reviewable event, not invisible.
8. DNS/SWG control for exfil channels. Block or alert on api.telegram.org from non-approved processes and on webhook/paste services. Drainers overwhelmingly use Telegram bots for exfil — it's cheap for attackers and loud for defenders.

Ongoing:

9. Track Socket, Phylum, and similar supply-chain research feeds — extension campaigns rotate constantly, and today's removed extension is tomorrow's re-upload under a new name. Build the cluster's tradecraft (code similarity, permission sets, exfil endpoints) into your threat intelligence watchlist rather than chasing individual IDs.

The Bottom Line

The official extension stores are a trusted delivery channel that adversaries have learned to abuse at scale — 19 extensions from one cluster in six months is a campaign, and there will be others. If your organization still allows unrestricted extension installation, you are accepting unreviewed third-party code execution inside every authenticated browser session your users have. Inventory what you have, allowlist what you need, and treat every extension as software that earned its way in.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub