Trusted Chrome, Edge extensions weaponized in supply chain campaign

Attackers have turned previously legitimate browser extensions into malware after acquiring them from legitimate publishers, potentially allowing malicious updates to reach users who had installed the software when it was still safe, researchers at Socket have found.

The campaign involved 19 extensions for Google Chrome and Microsoft Edge. Five had originally been developed by legitimate publishers and were later acquired by the attackers, according to Socket. The other 14 were created by the threat actor but did not contain malware when first released.

The findings highlight a security problem that can be difficult for users and companies to spot. An extension that appears safe when first installed can change after an ownership transfer or software update, while existing users may have little reason to revisit an earlier decision to trust it.

That risk is compounded by Chrome’s extension update process. Installed extensions are normally updated automatically, meaning malicious code added to a later release can reach users without requiring them to download another application or reinstall the extension.

One extension examined by Socket, called Enable Right Click & Copy — Smart Unlock + OCR, had about 70,000 users when the malicious code was added. It had initially been developed by PreppHint before being acquired by the threat actor. A related Edge extension had about 10,000 users. Socket said those numbers indicate the possible reach of the malware, rather than confirming that every user received an infected version.

Once installed, the malware could contact attacker-controlled infrastructure and receive additional JavaScript payloads. Socket found that it could remove Content Security Policy headers from websites opened in the browser, clearing the way for attacker-supplied code to run inside pages visited by the user.

The campaign was heavily focused on cryptocurrency theft, but its capabilities went further. Socket observed code that captured information typed into web forms and extracted authentication material from active browser sessions. Other modules targeted logged-in social media accounts and collected browser history.

Socket linked the extensions to a broader operation dating to February 2024 based on similarities with activity previously documented by DomainTools. The researchers said the malware’s design allowed attackers to change the payloads delivered to infected browsers over time.

Extensions become supply-chain risks

The campaign shows why companies can no longer treat approval of a browser extension as a one-time security decision, according to Keith Prabhu, founder and CEO of Confidis.
 
“CISOs should treat browser extensions as continuously changing third-party software, not as static productivity tools,” Prabhu said. “Organizations should move from ‘install approval’ to ‘lifecycle assurance’ for browser extensions.”

That means security teams may need to reassess extensions after deployment, particularly when ownership changes or new versions request broader permissions. Changes to code and publisher identity can provide early warning that an extension no longer carries the same risk profile it had when first approved.

Jonathan Ong, senior analyst for managed security services at Omdia, compared the tactic to attacks involving malicious mobile applications, where a clean initial version is used to gain approval before harmful code is introduced in a later update.

The similarity suggests that approval by an official software marketplace should not be treated as a lasting indicator of safety once an application or extension begins receiving updates.

Prabhu also recommended restricting extension access to sensitive corporate sites and monitoring the network connections and data activity generated by extensions.

Browser visibility remains limited

The attack also exposes a visibility problem for enterprise security teams. Tools already deployed across endpoints and networks may detect parts of an attack without necessarily seeing what a malicious extension is doing inside the browser.

“EDR, SWG, SASE, and managed browsers are valuable, but none of these controls, by themselves, provide reliable visibility into extension-level DOM access, CSP tampering, script injection, or token capture,” Prabhu said.

That gap makes browser telemetry more important in environments where employees rely heavily on extensions, particularly when malicious behavior takes place inside authenticated sessions rather than through a conventional executable running on the endpoint.

MDR services could help close that gap by incorporating browser telemetry into their monitoring, Ong said.

That could allow defenders to look for unusual extension behavior, such as attempts to remove CSP protections or establish WebSocket connections with previously untrusted domains, he added.

Response requires containment

Prabhu recommended determining when the malicious version was present on affected systems, revoking active sessions and refresh tokens, and rotating credentials or other secrets that may have been exposed. Incident responders should also examine browser, network, identity, and SaaS logs for signs of account misuse or unauthorized data access.

The investigation may also need to establish what information the extension was able to access, particularly if sensitive corporate or personal data was exposed.

Ong added that some MDR providers can help organizations determine the extent of data exposure following such an incident. That assessment can help enterprises understand whether the compromise may trigger breach notification or other regulatory requirements in the jurisdictions where they operate, Ong said.