{"investigation":{"slug":"superior-browser-extension-campaign-wallet-drainer","entity_name":"Superior Browser Extension Campaign — Wallet Drainer","trust_score":2,"severity_base":null,"score_modifier":-6,"confidence":0.88,"status":"published","content_type":"investigation","summary":"In August 2026 the security firm Socket reported 19 browser extensions (18 for Chrome, 1 for Edge), tracked as 'Superior', that allegedly delivered a multi-chain wallet drainer, seed-phrase phishing and credential-stealing modules through updates. Fourteen extensions were allegedly built by the operator and five bought from legitimate developers. Primary reporting is by Socket, with secondary coverage from The Hacker News and CyberInsider; Socket's original page could not be fetched directly in this review.","sections":[{"content":"Socket researchers reported 19 malicious browser extensions, 18 on Chrome and 1 on Edge, which it tracks under the name 'Superior'. According to secondary coverage of Socket's report, 14 of the extensions were created by the threat actor and 5 were acquired from previous legitimate owners and later updated with malicious code. Coverage dates the Socket report to 27-28 August 2026. The Hacker News and CyberInsider describe 16 injected malicious modules; the 16-module figure was reported for the compromised 'Enable Right Click & Copy' extension, and Gridinsoft describes 'up to 16' modules.","heading":"Overview of the campaign","sources":[{"url":"https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html","name":"The Hacker News - 19 Chrome and Edge extensions found","type":"news_article","credibility":2},{"url":"https://cyberinsider.com/19-chrome-and-edge-extensions-caught-harvesting-crypto-wallet-seeds/","name":"CyberInsider - 19 Chrome and Edge extensions caught harvesting crypto wallet seeds","type":"news_article","credibility":2},{"url":"https://www.plushcap.com/content/socket/blog/socket-19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads","name":"Plushcap mirror of Socket blog summary","type":"research","credibility":2}],"severity":"critical"},{"content":"The modules allegedly include a wallet drainer for EVM, Solana and Tron, fake Ledger and Trezor recovery pages to capture seed phrases, session theft, form and credential capture, Facebook and LinkedIn session theft, and browsing-history collection. On user numbers, sources differ: The Hacker News says the 'Enable Right Click & Copy' extension had about 80,000 users across Chrome and Edge, while CyberInsider and Gridinsoft report about 70,000 Chrome users and 10,000 Edge users for that extension. No campaign-wide total of users is stated in the sources reviewed, and these figures are potential install base rather than confirmed victims or confirmed losses.","heading":"Capabilities and affected users","sources":[{"url":"https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html","name":"The Hacker News","type":"news_article","credibility":2},{"url":"https://blog.gridinsoft.com/superior-malicious-browser-extensions/","name":"Gridinsoft - Superior: 19 Browser Extensions Steal Wallets and Passwords","type":"news_article","credibility":3},{"url":"https://cyberinsider.com/19-chrome-and-edge-extensions-caught-harvesting-crypto-wallet-seeds/","name":"CyberInsider","type":"news_article","credibility":2}],"severity":"high"},{"content":"CyberInsider reports that Socket linked the campaign to earlier DomainTools research based on shared techniques and similar infrastructure; The Hacker News says DomainTools documented aspects of the campaign in May 2025. The exact date of any DomainTools newsletter and the number of primary command-and-control domains could not be verified: none of the sources retrieved state a C2 domain count, and Socket's page returned HTTP 403 when fetched. Earlier claims of 20 or 21 C2 domains and a specific newsletter date are therefore omitted. CyberInsider reports Google removed the Chrome version of 'Enable Right Click & Copy' and that the Edge version remained active at the time of Socket's report, with a new C2 domain used in an August 14 update. The current status of the other extensions is unknown. No attribution to a named individual or group is established.","heading":"Infrastructure, attribution and takedown status","sources":[{"url":"https://cyberinsider.com/19-chrome-and-edge-extensions-caught-harvesting-crypto-wallet-seeds/","name":"CyberInsider","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html","name":"The Hacker News","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2025-05","event":"DomainTools Investigations reportedly documented aspects of related activity (per The Hacker News).","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html"},{"date":"2026-08","event":"Edge version of 'Enable Right Click & Copy' reportedly moved to a new C2 domain in an update dated August 14.","source":"CyberInsider","source_url":"https://cyberinsider.com/19-chrome-and-edge-extensions-caught-harvesting-crypto-wallet-seeds/"},{"date":"2026-08","event":"Socket published its report on the 19 'Superior' extensions; coverage dated 27-28 August 2026.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html"}],"sources_used":[{"url":"https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html","name":"The Hacker News","type":"news_article","credibility":2},{"url":"https://cyberinsider.com/19-chrome-and-edge-extensions-caught-harvesting-crypto-wallet-seeds/","name":"CyberInsider","type":"news_article","credibility":2},{"url":"https://blog.gridinsoft.com/superior-malicious-browser-extensions/","name":"Gridinsoft","type":"news_article","credibility":3},{"url":"https://www.plushcap.com/content/socket/blog/socket-19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads","name":"Plushcap mirror of Socket blog summary","type":"research","credibility":2}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-01T23:49:25.791527+00:00","updated_at":"2026-11-04T09:57:20.739+00:00"},"source_quality":{"total":4,"tier1":0,"tier2":0,"tier3":0,"unrated":4},"follower_count":null,"content_updated_at":"2026-11-04T09:57:21.410Z","last_fact_checked_at":"2026-11-04T09:57:21.009Z","fact_check_next_allowed_at":"2026-11-11T09:57:21.009Z","update_next_allowed_at":"2026-11-11T09:30:02.654Z"}