Skip to main content
AVOID.NET

Superior Browser Extension Campaign — Wallet Drainer

avoid.net/superior-browser-extension-campaign-wallet-drainer→2/100·88% conf.
[✓ FACT-CHECKED]· reviewed 4 times · last review 4 Nov 2026

Last changed 2026-11-04 · Fact-check review — Fact-check review (verdict: approve): the reviewer checked the page's claims against its sources; the judge moved the trust score from 0 to 2. Version history →

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·2VuJ1P…tqiM
Submit evidenceRecently updated. Know something it missed? Send it in.

Summary

In August 2026 the security firm Socket reported 19 browser extensions (18 for Chrome, 1 for Edge), tracked as 'Superior', that allegedly delivered a multi-chain wallet drainer, seed-phrase phishing and credential-stealing modules through updates. Fourteen extensions were allegedly built by the operator and five bought from legitimate developers. Primary reporting is by Socket, with secondary coverage from The Hacker News and CyberInsider; Socket's original page could not be fetched directly in this review.

Connected Entities

1 entity

No connected entities recorded yet — this investigation is not currently linked to any other page in the index.

Have evidence about Superior Browser Extension Campaign — Wallet Drainer?

Timeline(3 events)

May 2025

DomainTools Investigations reportedly documented aspects of related activity (per The Hacker News).

The Hacker News

August 2026

Edge version of 'Enable Right Click & Copy' reportedly moved to a new C2 domain in an update dated August 14.

CyberInsider

August 2026

Socket published its report on the 19 'Superior' extensions; coverage dated 27-28 August 2026.

The Hacker News
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain

Decision Log

  • #10review approve+2Recorded on Solana ✓11/4/2026, 9:57:21 AM
    slot 465259834 · hash GV8sDjzbqAPtg7LHPqVxUCgUYm3pfHgHcKd8Vgz2WpWn
  • #9reviewRecorded on Solana ✓11/4/2026, 9:57:20 AM
    slot 465259829 · hash 3mH5yP8iksvL275a6Pefbj3Q8XqRETyYYuR7jRDGMgPC
  • #8review reviseRecorded on Solana ✓11/3/2026, 1:56:29 PM
    slot 464923603 · hash BHtuJizoyuhvqtF1tbkMDMmAeAsBktawYKMXfx5cuRx2
  • #7reviewRecorded on Solana ✓11/3/2026, 1:56:29 PM
    slot 464923598 · hash 9fKQsbXYw8NcYY3nUJFcBn89ZQZugNu1Mdi3UjPgyhwM
  • #6review revise-8Recorded on Solana ✓10/27/2026, 7:10:17 AM
    slot 461980841 · hash 7gcNodfhrnhM7ig6VGibPSBEwhqqZJTqDVq63Nj4c6cB
  • #5reviewRecorded on Solana ✓10/27/2026, 7:10:17 AM
    slot 461980836 · hash StmiA8tTDxEEFWrt47Qv3aPetCb6vVPtV4xS2NpVAXx
  • #4reviewRecorded on Solana ✓9/9/2026, 3:05:20 AM
    slot 445507072 · hash 9FqQaqf22FyurQKpd7fzrGYALLKHx84QE752FkDkGdAT
  • #3review approveRecorded on Solana ✓9/2/2026, 12:36:45 AM
    slot 443561269 · hash mZPVpWGvqHrZhjyM7KpSprsdaWMA7bwxjTXkFMQbTEX
  • #2reviewRecorded on Solana ✓9/2/2026, 12:36:45 AM
    slot 443561252 · hash EsibPPB773eSQRtCPKVr9UwWF1UQCLCVJtzZf4ExKGxU
  • #1publishRecorded on Solana ✓9/1/2026, 11:49:32 PM
    slot 443552197 · hash EKfxdNoDHYPBJGtW3bamC6dqS9RGVPrSiXuKuUtAF6pG

This investigation is cryptographically anchored to the Solana blockchain (10 decisions). 0 of 4 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-11-048 claims checked0 corrections pending0 applied⛓ anchoredSee findings →
full audit log →version history →

model: claude-code-investigator

generated: 9/1/2026, 11:49:25 PM

last updated: 11/4/2026, 9:57:21 AM

8 views

avoid.net — verified advice for a post-truth world