Affected Systems

19 browser extensions (18 Chrome, 1 Edge) published since February 2024, with "Enable Right Click & Copy — Smart Unlock + OCR" having 80,000 installs. Extensions either created by threat actor or purchased from legitimate owners. All versions with malicious code establish C2 connections and inject JavaScript modules targeting cryptocurrency wallets, credentials, and social media accounts.

Exploitation Status

Active exploitation confirmed since February 2024. Campaign tracked as "Superior" by Socket. Threat actor leverages Chrome's auto-update mechanism to push malicious versions to users who installed clean extensions. WebSocket C2 infrastructure observed in the wild with dynamic endpoint rotation.

Business Impact

Organizations face credential theft, cryptocurrency wallet draining, and browser history exfiltration. Extensions strip Content Security Policy headers and inject 16 malicious modules including multi-chain wallet drainers, hardware wallet seed-phrase harvesters, exchange account stealers, and ClickFix-style social engineering lures. Auto-update behavior means previously safe extensions become compromised without user action. Threat actor demonstrates sophistication by acquiring legitimate extensions to inherit trust and user base.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit and remove all 19 listed extensions from enterprise Chrome and Edge deployments using Group Policy or MDM (full list includes koccklolohdacbfooifnpebakpbeipc, fegckejpfnlmfgkfjpinlbgmeeijjkel, kdenlnncndfnhkognokgfpabgkgehodd, and 16 others)
  • Implement browser extension allowlisting via Chrome Enterprise policies (ExtensionInstallBlocklist and ExtensionInstallAllowlist) to prevent unauthorized extension installation
  • Monitor network traffic for WebSocket connections to unknown C2 infrastructure from browser processes; correlate with extension activity logs
  • Educate users on risks of browser extensions that request broad permissions, especially those related to clipboard access, content script injection, or cryptocurrency functionality
  • Review browser extension inventory monthly and validate that extensions have not changed ownership or introduced new permissions in recent updates