Security researchers have identified 19 malicious Chrome and Microsoft Edge extensions capable of stealing passwords, browser history, account details and information typed into online forms. Five had originally been legitimate tools before being acquired and weaponised, meaning an extension that appeared trustworthy could have become dangerous through an automatic update.
The extensions have now been removed from the stores, but anyone who installed one should remove it, assume credentials entered through that browser may be compromised, change important passwords from a clean device and review active account sessions.
What did the malicious browser extensions do?
The extensions acted as a flexible malware platform inside Chrome or Edge. According to Socket’s 27 August 2026 investigation, the malicious code could remove browser security protections, inject scripts into websites and download further capabilities from attacker-controlled servers.
Observed functions included recording passwords and form entries across websites, stealing authenticated sessions and account information, harvesting Facebook and LinkedIn data, copying browser history, and showing fake browser-update instructions designed to make users run attacker-supplied commands.
Although cryptocurrency theft was a major focus, the universal credential and form-grabbing capability makes the campaign relevant to ordinary business accounts too.
Which Chrome and Edge extensions were affected?
Socket linked the following 19 extension names to the campaign. The names matter because removed extensions may no longer appear in store searches, while users may still recognise an extension they installed previously.
- Enable Right Click & Copy — Smart Unlock + OCR
- RapidLens — Google Lens for Screen Search & Images
- QuickLens — Search Screen with Google Lens
- Password Protect PDF
- Allow Copy — Select & Enable Right Click (Edge)
- PixelCheck
- Creative Library — Ad Spy Tool
- Website Traffic Checker: MirrorSphere SEO Stats
- Site Signal — Website Traffic & SEO Checker
- SEO Pulse Pro — Website Traffic & SEO Analyzer
- Private Crypto News Reader
- Blockfolio: Address Monitor
- Crypto Rates & Fiat Converter
- Crypto Alerter: Price Alarms & Volatility Warnings
- DeFi Pulse Tracker
- Crypto Price Badge: Quick Glance
- Multi-Chain Explorer
- LedgerLook: Wallet Checker
- Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Ray
The largest potential exposure came from the Chrome and Edge versions of the right-click utility, which together had around 80,000 users when malicious functionality was introduced. That figure describes potential exposure, not a confirmed count of compromised users.
How can you check installed extensions?
In Chrome, type chrome://extensions into the address bar. In Microsoft Edge, type edge://extensions. Review every installed item, including extensions that are switched off, and remove anything on the affected list.
Do not rely only on the extension’s visible name. If there is uncertainty, open its details and compare the extension ID with the indicators in Socket’s original research.
Businesses should also review centrally managed browser policies. Staff can install small productivity tools without recognising that an extension may read and change data across every website they visit.
What should you do if one was installed?
- Remove the extension. Check every browser profile used on the device, including personal profiles used for work.
- Disconnect the device if it behaves suspiciously. Fake update prompts, unexpected commands or unusual browser activity should be treated as possible malware.
- Change important passwords from a clean device. Start with email, Microsoft 365, banking, password managers and administrator accounts.
- Sign out active sessions. A password change alone may not invalidate every stolen session token.
- Review MFA methods and recovery details. Check for unfamiliar authentication methods, forwarding rules or account changes.
- Run an endpoint security investigation. The extension could display fake update instructions that lead to additional malware outside the browser.
- Check business accounts for unusual activity. Review sign-in logs, financial transactions, social-media administration and password-reset events.
If staff entered sensitive customer or company information while an affected extension was active, record what may have been exposed and take incident-response advice rather than assuming removal alone has resolved the risk.
Why could a legitimate-looking extension become malicious?
Five extensions identified by Socket began as legitimate products and were later bought by the threat actor. A clean first version built trust and users; a later automatic update introduced malicious behaviour.
Browser stores removing known malicious items is important, but it does not remove the wider risk. Extension ownership can change without an obvious warning to users, and automatic updates can add new permissions or code after installation.
KES has a practical guide to checking browser add-ons before trusting them. For company-managed devices, an approved-extension list is safer than allowing unrestricted installation.
BROWSER SECURITY CHECK
Unsure what extensions are installed across your business?
KES can review managed browsers and endpoints, identify unwanted add-ons, check account activity and help contain suspected credential theft for businesses across Kent.
Quick answers
Have the malicious extensions been removed?
BleepingComputer reported on 30 August that none of the identified extensions remained available in the Chrome Web Store. Removal from a store does not remove the need for former users to check their browsers and credentials.
Is changing the password enough?
Not always. The malware could steal session tokens as well as passwords, so affected users should also revoke active sessions, review MFA methods and check account activity.
Were only cryptocurrency users at risk?
No. Researchers observed broad credential and form capture, browser-history theft and Facebook and LinkedIn data harvesting, although cryptocurrency wallets and exchanges were prominent targets.
Can antivirus replace an extension review?
No. Managed endpoint protection can help detect suspicious behaviour, but businesses should still control which extensions users can install and regularly remove unnecessary add-ons.
Sources
- Socket: 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads — published 27 August 2026.
- BleepingComputer: Chrome Web Store extensions caught stealing crypto and browser data — updated 30 August 2026.
- Google Chrome Help: Install and manage extensions.
This article reflects the published research and store status checked on 31 August 2026. Security findings and removal status can change as investigations continue.
