Research identified 19 malicious browser extensions 18 for Google Chrome and 1 for Microsoft Edge that use a modular malware framework to strip website Content Security Policy protections, inject attacker-controlled JavaScript.
Socket determined that 14 extensions were created by the threat actor, while five were acquired from legitimate developers and subsequently weaponized.
The most consequential example is “Enable Right Click & Copy Smart Unlock + OCR,” which was initially developed by PreppHint and later acquired by the actor.
The identified set includes SEO tools, crypto-price trackers, screen-search utilities, ad-spying tools, and right-click enablers.
The malicious update was introduced when the extension had roughly 70,000 users. A related Edge version, “Allow Copy – Select & Enable Right Click,” had approximately 10,000 users, creating an estimated exposure surface of up to 80,000 installations.
Socket said Chrome removed the malicious Chrome listing, but the Edge version remained active when the research was published and had received a new C2 domain in an August 14, 2026 update.
The malicious extensions use background service workers to establish encrypted WebSocket channels with command-and-control infrastructure.
Each installation receives a UUID, while downloaded JavaScript modules are encrypted with AES-GCM using a key derived from the extension ID and installation UUID.
The framework maintains a heartbeat connection, typically every five minutes, and can accept C2 rotation instructions. This gives operators the ability to move victims between backend servers, segment infrastructure, and assign distinct data-exfiltration endpoints per victim.
The payload architecture is especially concerning because the extensions can download new modules after installation, allowing the threat actor to change objectives without publishing a visibly suspicious static package update.
This operational model echoes earlier research from DomainTools, which documented malicious Chrome extensions dating to February 2024.
Combined legitimate-looking functionality with remote code retrieval, arbitrary script execution, broad browser permissions, and persistent backend communications.
DomainTools also observed DOM event-handler techniques designed to bypass or weaken CSP controls.
Malicious browser extensions, tracked by Socket as “Superior,” relies on seemingly legitimate utility extensions that initially provide their advertised functionality before later updates introduce malicious code.
Chrome and Edge Extensions
On startup, the malicious service worker creates dynamic declarativeNetRequest rules that remove Content-Security-Policy, Content-Security-Policy-Report-Only, X-WebKit-CSP, and X-Content-Security-Policy response headers across main frames, subframes, and XMLHttpRequests.
CSP ordinarily constrains which scripts and resources a website can load, helping mitigate cross-site scripting and content injection. By removing it, the extension clears a path for attacker-provided code to execute in targeted websites.
The malware then uses content scripts and Chrome extension APIs to retrieve encrypted modules from chrome.storage.local.
Newer samples dynamically inject scripts through chrome.scripting.executeScript, reducing the visibility associated with static wildcard content-script declarations.
To cross into the webpage’s main execution world, the extensions create hidden DOM objects such as , , or
