Security researchers have discovered 19 malicious browser extensions targeting Google Chrome and Microsoft Edge users.

The group includes 18 Chrome extensions and one Microsoft Edge extension. Researchers track the campaign under the name Superior.

The extensions can steal sensitive data. This includes crypto wallets, seed phrases, passwords, login sessions, and browser history.

How Does the Campaign Work?

The attack method is unusual because the extensions are not always malicious from the start.

Instead, some extensions first work as normal tools. After gaining users and positive reviews, attackers release an update containing malicious code.

In addition, five extensions were purchased from their previous developers. This gave the attackers access to an existing user base.

Since browsers normally update extensions automatically, malicious code can reach users without requiring a new installation.

What Can the Extensions Steal?

The malware includes several different modules.

Some modules can steal crypto wallets and hardware wallet seed phrases. Others target exchange accounts, passwords, login forms, Facebook accounts, and LinkedIn accounts.

Browser history can also be collected.

In addition, the extensions connect to command-and-control servers. Attackers can then send new instructions or load additional JavaScript code.

Some of the Affected Extensions

The identified extensions include Enable Right Click & Copy — Smart Unlock + OCR, RapidLens, QuickLens, Password Protect PDF, and Allow Copy.

Several extensions also target crypto users. Examples include Blockfolio: Address Monitor, Crypto Rates & Fiat Converter, DeFi Pulse Tracker, and LedgerLook: Wallet Checker.

One of the most widely installed extensions had around 80,000 users.

What Should Users Do?

First, review all installed extensions in Chrome and Edge.

If you find a suspicious extension, remove it immediately. After that, change passwords for important accounts and review recent login activity.

Crypto users should also consider moving their funds if there is any chance that a seed phrase or wallet data was exposed.

Finally, keep the number of browser extensions low. Install only the tools you truly need and trust.

Key Takeaway

This campaign shows that a browser extension can appear safe and later become malicious through an update.

Therefore, users should not rely only on ratings or download numbers. Installed extensions should also be reviewed regularly.

In the end, using fewer extensions can reduce the risk of credential theft, crypto loss, and browser data exposure.

Source: https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html