Malicious Chrome and Edge Extensions Stealing Crypto and Browser Data: Detection and Removal Guide

---
title: Chrome or Edge Spawning Command Interpreter After Possible ClickFix Lure
id: 8d1c9b2a-6f35-4e8b-9c41-7a2d5f0b6e11
status: experimental
description: Detects Chrome or Edge launching PowerShell, cmd, mshta, rundll32, or script hosts with download/cradle-like command lines, consistent with ClickFix paste-and-run social engineering.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/01/08
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_cli:
    CommandLine|contains:
      - ' -enc'
      - 'FromBase64String'
      - 'Invoke-Expression'
      - 'IEX'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'DownloadString'
      - 'Start-BitsTransfer'
      - 'curl '
      - 'mshta http'
      - 'http://'
      - 'https://'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Rare enterprise browser integrations or admin troubleshooting launched from a browser tab
level: high
---
title: Non-Browser Process Accessing Chrome or Edge Credential and History Stores
id: 4f6a21d7-9b0e-4c5f-a2d3-91e7c0b8a442
status: experimental
description: Detects processes other than the browser touching Chrome or Edge Login Data, Cookies, History, or Web Data stores, a common pattern in browser-data theft.
references:
  - https://attack.mitre.org/techniques/T1539/
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/01/08
tags:
  - attack.collection
  - attack.credential_access
  - attack.t1539
  - attack.t1555.003
logsource:
  category: process_access
  product: windows
detection:
  selection_target:
    TargetImage|contains:
      - 'Login Data'
      - 'Cookies'
      - 'History'
      - 'Web Data'
  selection_profile:
    TargetImage|contains:
      - 'Google'
      - 'Chrome'
      - 'Microsoft'
      - 'Edge'
      - 'User Data'
  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  condition: selection_target and selection_profile and not filter_browser
falsepositives:
  - EDR, DLP, backup, forensic, and password-management tools legitimately inspecting browser stores
level: medium
---
title: User-Launched Run Dialog Followed by Script or Download Cradle
id: 1b7e2c94-55aa-4d6f-8bd0-3f9c2a7d10ef
status: experimental
description: Detects explorer.exe launching common ClickFix execution chains shortly after user interaction, such as Run dialog paste-ins that start PowerShell, mshta, or curl-like download execution.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/01/08
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
  selection_cli:
    CommandLine|contains:
      - ' -enc'
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'DownloadString'
      - 'mshta http'
      - 'http://'
      - 'https://'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Administrators using Run dialog for legitimate scripts; restrict by user role and expected software deployment paths
level: medium

// Hunt browser-launched command execution consistent with ClickFix paste-and-run activity
let lookback = 14d;
let suspiciousCli = dynamic(["-enc", "FromBase64String", "Invoke-Expression", "IEX", "Invoke-WebRequest", "Invoke-RestMethod", "DownloadString", "Start-BitsTransfer", "mshta http", "http://", "https://"]);
DeviceProcessEvents
| where Timestamp >= ago(lookback)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any (suspiciousCli)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, ProcessId, InitiatingProcessId
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp >= ago(lookback)
    | project DeviceName, InitiatingProcessId, RemoteUrl, RemoteIP, RemotePort, Timestamp
) on DeviceName, InitiatingProcessId
| sort by Timestamp desc;

-- Find command interpreters spawned under Chrome or Edge with network or encoded-command indicators
LET browsers = SELECT Pid, Name, Exe, Username FROM pslist() WHERE Name =~ '^(chrome|msedge)\\.exe$'
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '^(powershell|pwsh|cmd|mshta|rundll32|regsvr32|wscript|cscript)\\.exe$'
  AND CommandLine =~ '(?i)(-enc|frombase64string|invoke-expression|iex|invoke-webrequest|invoke-restmethod|downloadstring|start-bitstransfer|https?://)'

# Audit Chrome and Edge extensions, score risky permissions, and optionally enforce allowlist/blocklist policy.
# Run as Administrator for policy hardening. Default is audit-only and does not remove extensions.
param(
  [switch]$ApplyHardening,
  [string[]]$ApprovedExtensionIds = @("REPLACE_WITH_APPROVED_CHROME_OR_EDGE_EXTENSION_ID"),
  [string]$ReportPath = "$env:ProgramData\SecurityArsenal\BrowserExtensionAudit.csv"
)

$riskyPermissions = @("history","cookies","tabs","activeTab","storage","scripting","clipboardRead","clipboardWrite","webRequest","webRequestBlocking","declarativeNetRequest","declarativeNetRequestWithHostAccess","nativeMessaging","management","downloads","privacy","proxy","contentSettings","<all_urls>","*://*/*")
$browserRoots = @(
  @{Browser="Chrome"; Base="$env:LOCALAPPDATA\Google\Chrome\User Data"},
  @{Browser="Edge"; Base="$env:LOCALAPPDATA\Microsoft\Edge\User Data"}
)

$results = New-Object System.Collections.Generic.List[object]
foreach ($root in $browserRoots) {
  if (-not (Test-Path $root.Base)) { continue }
  $profiles = Get-ChildItem -Path $root.Base -Directory -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq "Default" -or $_.Name -like "Profile*" }
  foreach ($profile in $profiles) {
    $extDir = Join-Path $profile.FullName "Extensions"
    if (-not (Test-Path $extDir)) { continue }
    foreach ($ext in Get-ChildItem $extDir -Directory -ErrorAction SilentlyContinue) {
      foreach ($ver in Get-ChildItem $ext.FullName -Directory -ErrorAction SilentlyContinue) {
        $manifest = Join-Path $ver.FullName "manifest.json"
        if (-not (Test-Path $manifest)) { continue }
        try { $m = Get-Content $manifest -Raw | ConvertFrom-Json } catch { continue }
        $perms = @()
        if ($m.permissions) { $perms += $m.permissions }
        if ($m.optional_permissions) { $perms += $m.optional_permissions }
        $hostPerms = @()
        if ($m.host_permissions) { $hostPerms += $m.host_permissions }
        $matches = @($perms + $hostPerms | Where-Object { $riskyPermissions -contains $_ -or $_ -like "*://*/*" -or $_ -eq "<all_urls>" })
        $score = 0
        if ($matches.Count -ge 1) { $score += 2 }
        if ($matches.Count -ge 4) { $score += 3 }
        if (($perms + $hostPerms) -match "nativeMessaging|management|webRequest|declarativeNetRequest|cookies|history") { $score += 3 }
        $results.Add([pscustomobject]@{
          Browser=$root.Browser; Profile=$profile.Name; ExtensionId=$ext.Name; Version=$ver.Name
          Name=$m.name; RiskScore=$score; RiskyPermissions=($matches -join ";"); AllPermissions=(($perms + $hostPerms) -join ";")
          ManifestPath=$manifest
        })
      }
    }
  }
}

New-Item -ItemType Directory -Force -Path (Split-Path $ReportPath) | Out-Null
$results | Sort-Object RiskScore -Descending | Export-Csv -NoTypeInformation -Path $ReportPath
Write-Host "Audit complete: $ReportPath"

if ($ApplyHardening) {
  # Enforce default-deny for extensions. Only allow explicitly approved IDs. Test in a pilot OU first.
  $chromePolicy = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist"
  $edgePolicy = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist"
  $chromeAllow = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist"
  $edgeAllow = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist"
  foreach ($p in @($chromePolicy,$edgePolicy,$chromeAllow,$edgeAllow)) { New-Item -Force -Path $p | Out-Null }
  Set-ItemProperty -Path $chromePolicy -Name "1" -Value "*"
  Set-ItemProperty -Path $edgePolicy -Name "1" -Value "*"
  $i = 1
  foreach ($id in $ApprovedExtensionIds) {
    Set-ItemProperty -Path $chromeAllow -Name "$i" -Value $id
    Set-ItemProperty -Path $edgeAllow -Name "$i" -Value $id
    $i++
  }
  Write-Host "Hardening applied. Replace ApprovedExtensionIds with your sanctioned list before broad rollout."
}