Affected Systems

Google Chrome and Microsoft Edge users who installed any of 19 malicious extensions, including "Enable Right Click & Copy" (70,000+ Chrome users, 10,000+ Edge users). Campaign active since early 2024. Five extensions were legitimate but later compromised via malicious updates. All extensions removed from Chrome Web Store; some remained on Edge store at time of disclosure.

Exploitation Status

Active campaign confirmed. Malware framework deployed 19 distinct modules via encrypted WebSocket C2 connections. Extensions delivered malicious JavaScript modules, removed CSP headers, and injected scripts into websites. Threat actors acquired legitimate extensions and weaponized them through updates.

Business Impact

Users exposed to credential theft across all websites, cryptocurrency wallet draining (EVM, Solana, Tron), session hijacking from major exchanges (Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, MetaMask), seed phrase phishing via fake Ledger/Trezor pages, browser history exfiltration, and ClickFix social engineering attacks. Framework is modular and extensible, indicating ongoing payload development. Organizations face credential compromise, financial loss, and potential lateral movement if corporate accounts were accessed from affected browsers.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all Chrome and Edge browser extensions across endpoints; remove any matching the 19 extension IDs listed by Socket (pkoccklolohdacbfooifnpebakpbeipc, fegckejpfnlmfgkfjpinlbgmeeijjkel, kdenlnncndfnhkognokgfpabgkgehodd, jamminefolhgepgihbmcjjhgldbfcikp, inmkjedjdhgpknjogbjomhnbgdccckkg, fcgdejjichpgfaaafflplhfijcnieopb, cfpnjdbpojpcongfaefcamjbaolpelcd, aapdalkmclfaahehnmicbglkohkldhne, dkdadldmiefjldmegbjbnhhfddnkhlhm, fjmlhlkccegopebcllcmafahkmeejpph, iekoapohahgmogbagegmcgplbkikcgke, ahpnnnjbnfbhoikhohglpohnoocjcoco, oeacadlaclegkkkdehjmiifnjhcekclj, jmlgannjlbliikgcaieomgmcnfplglea, lhmcajhgadanidbopgaoobjlldegjmke, gfackggoapepdmnjnkblogdcjpgcjiak, hfijkbdkpidafdbeebnnkhfccildbcle, pcngchfbfgejllcbhmeadjhiebebiome, aodkjdeghbjiaienipfjkbpcikkacbcp)
  • Force password resets for users who installed affected extensions; prioritize accounts for financial services, cryptocurrency exchanges, and corporate SSO
  • Instruct cryptocurrency holders to immediately transfer assets to newly created wallets with fresh seed phrases; treat existing wallets as compromised
  • Review network logs for WebSocket connections to C2 domains listed in Socket's report; investigate any matches for scope of compromise
  • Deploy browser extension whitelisting via Group Policy (Chrome) or Intune (Edge) to prevent installation of unapproved extensions