Fact-check findings
What an automated fact-checker found when it re-read Superior Browser Extension Campaign — Wallet Drainer against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #8[partially supported][awaiting moderator]in section: Overview of the campaign
“Coverage dates the Socket report to 27-28 August 2026.”
reviewerCoverage dated 27-28 August 2026Aug 28 confirmed for the coverage; Aug 27 for Socket not verified.
confirmed
7 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Overview of the campaign
“Socket researchers reported 19 malicious browser extensions, 18 on Chrome and 1 on Edge, which it tracks under the name 'Superior'.”
reviewer19 extensions, 18 Chrome and 1 Edge, tracked as SuperiorMatches The Hacker News and search summaries. - #2[confirmed][no action needed]in section: Overview of the campaign
“14 of the extensions were created by the threat actor and 5 were acquired from previous legitimate owners and later updated with malicious code”
reviewer14 built by operator, 5 acquiredConfirmed by both outlets. - #3[confirmed][no action needed]in section: Overview of the campaign
“The Hacker News and CyberInsider describe 16 injected malicious modules”
reviewer16 modules, reported for Enable Right Click & CopyGridinsoft 'up to 16' not fetched. - #4[confirmed][no action needed]in section: Capabilities and affected users
“The Hacker News says the 'Enable Right Click & Copy' extension had about 80,000 users across Chrome and Edge”
reviewerUser counts differ: THN 80,000 combined; CyberInsider 70,000 Chrome + 10,000 EdgeThe figures are consistent; the page's framing of a difference is slightly overstated but accurate. - #5[confirmed][no action needed]in section: Capabilities and affected users
“The modules allegedly include a wallet drainer for EVM, Solana and Tron, fake Ledger and Trezor recovery pages to capture seed phrases”
reviewerCapabilities: drainer for EVM, Solana, Tron; fake Ledger/Trezor pagesSupported. - #6[confirmed][no action needed]in section: Infrastructure, attribution and takedown status
“CyberInsider reports Google removed the Chrome version of 'Enable Right Click & Copy' and that the Edge version remained active at the time of Socket's report, with a new C2 domain used in an August 14 update.”
reviewerGoogle removed Chrome version of Enable Right Click & Copy; Edge version active with Aug 14 C2 updateAccurately attributed. - #7[confirmed][no action needed]in the timeline
“DomainTools Investigations reportedly documented aspects of related activity (per The Hacker News).”
reviewerDomainTools documented aspects in May 2025 (per THN)Confirmed.