20 Chrome Extensions Hijacked to Steal Crypto and Inject ClickFix: Audit Your Browser Now

Chrome extension supply chain attacks exploit a structural weakness in the browser extension ecosystem: legitimate extensions can transfer ownership through broker platforms, and the receiving owner inherits both the install base and the ability to push updates through the original, trusted listing.

In this campaign, attackers used ExtensionHub, a marketplace where developers list extensions for sale. After acquisition, the new owner submitted version updates containing the malicious framework. Because Chrome's update mechanism delivers these updates silently to all existing users, the attacker gained immediate access to the full install base of each acquired extension without requiring any user interaction beyond the original install.

The malicious update for QuickLens, version 5.8 released February 17, 2026, added two new permission categories: declarativeNetRequest, which enables dynamic modification of HTTP request and response headers, and webRequest, which enables interception and inspection of all network traffic. These permissions allow the malware to strip Content Security Policy headers from every website, opening the door for arbitrary JavaScript injection regardless of the site's own security posture.

Not all affected extensions were acquired through brokers. Some extensions in the campaign were published as malicious tools designed to mimic legitimate utility names, relying on organic discoverability and user confusion for initial installs. This hybrid strategy made the campaign harder to detect through reputation-based signals alone, since newly malicious updates to established extensions carry the extension's full accumulated review history and user count.

The campaign's reach varied across the affected extensions. The largest single extension, Enable Right Click and Copy, accumulated more than 70,000 active Chrome installs and 10,000 Edge installs before the malicious update deployed. Five of the 20-plus extensions were established tools compromised through ownership transfer; the remainder were purpose-built malicious extensions that mimicked legitimate names to attract organic installs.

Socket's analysis identified 19 discrete malware modules distributed across the campaign's extensions. Each module handles a specific function: dedicated modules target each of the 11 supported cryptocurrency wallet browser extensions, additional modules handle session credential harvesting and browser history exfiltration, and two modules manage the ClickFix social engineering payload delivery and the command-and-control polling loop.

The attacker infrastructure uses a C2 polling interval of five minutes, with each infected browser establishing an encrypted WebSocket connection to api.extensionanalyticspro.top and transmitting system metadata including OS version, installed extensions list, and browser profile data. This telemetry enables the attacker to identify high-value targets such as machines with multiple cryptocurrency wallet extensions installed and prioritize those sessions for manual interaction.

A secondary payload delivery domain, google-update.icu, serves fake Google Update prompt overlays that form the ClickFix social engineering component. The domains were registered using Chinese registrar infrastructure and share WHOIS characteristics with the signing certificate used for the Windows PE dropper deployed in the second attack stage.

The malware framework operates as a modular post-installation payload that loads individual JavaScript modules on demand from the C2 server. This architecture lets the attacker add new capabilities without pushing a new extension update and limits exposure to static analysis tools that inspect extension packages at rest.

Cryptocurrency targeting modules watch for navigation to any of 11 wallet extension interfaces: MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Solflare, Backpack, Brave Wallet, Exodus, Binance Chain Wallet, WalletConnect, and Argon. When a matching page loads, the module replaces the legitimate wallet interface with a pixel-accurate phishing overlay and prompts the user to confirm their seed phrase for a fabricated security check. Captured seed phrases are transmitted immediately to the C2 infrastructure.

The credential harvesting module intercepts form submission events across all sites and captures username and password fields before encryption. A session harvesting module captures authentication cookies from financial, exchange, and social media accounts. The browser history module exfiltrates the full browsing history to map target activity patterns and identify additional high-value accounts to prioritize.

The ClickFix module activates when no higher-priority target such as a crypto wallet is detected in the current session. It injects a fullscreen overlay mimicking a Google Chrome update prompt, instructs the user to press a keyboard shortcut to copy a command to their clipboard, and provides a PowerShell command that downloads googleupdate.exe from drivers.solutions. The executable is signed with a certificate issued to Hubei Da'e Zhidao Food Technology Co., Ltd., a company with no established technology product history, which the attackers use to bypass certificate-based execution controls on Windows systems.

The full attack chain from extension install to cryptocurrency theft follows seven discrete steps, all occurring without any user action beyond the original extension installation.

The following indicators are drawn from Socket's August 30 research report and the Rescana QuickLens technical analysis. Block the C2 domains at DNS resolvers and proxy egress controls immediately. Alert on the Katzilla user agent in web proxy logs as a high-confidence indicator of active infection. Any endpoint executing googleupdate.exe from a path outside C:\Program Files\Google\Update\ should be treated as compromised and isolated for forensic review.

Secondary context: PaperCut CVE-2026-81578 and CVE-2026-82078, a pre-authentication RCE chain in PaperCut NG and MF print management servers, also reached active exploitation status this week with 47 percent of tracked installations on unpatched versions. Apply Emergency Patch Release 2 from PaperCut's security advisory if your environment runs version 24, 25, or 26. Isolate internet-exposed PaperCut servers running version 23 or earlier until an upgrade path is available.

No CVE-specific community Sigma rules exist for this campaign. Socket's research was published August 30, 2026, and SigmaHQ community coverage for browser extension malware typically requires confirmed exploitation artifacts published weeks after initial disclosure. The two rules below were generated by Decryption Digest from the documented attack mechanisms and should be validated against your proxy baseline and endpoint event logs before production deployment. Both carry status: experimental.

Rule 1 targets the Katzilla user agent in proxy logs, the network-level signal for an infected browser downloading payload modules from the C2 infrastructure. This is a high-confidence detection with minimal false positive risk since Katzilla is not a recognized browser or HTTP client string.

Rule 2 targets Chrome spawning googleupdate.exe from any path outside the legitimate Google Updater directory, a pattern specific to the ClickFix dropper component of this campaign. Deploy via your EDR's process creation telemetry.

The WAF rules below target the Katzilla user agent and C2 domain patterns at the network egress layer. While this attack is primarily browser-based, blocking C2 communication at the proxy layer prevents module download and stops the crypto drain modules from receiving targeting updates. Deploy in log mode first to baseline false positive rates.

Organizations with managed endpoints running Chrome or Edge should treat this campaign as an active credential breach until extension audits are complete. Any extension installed before August 30 that is not on an explicitly approved allowlist should be quarantined pending review against Socket's full extension ID list.

Chrome extensions represent a largely unmanaged attack surface in most enterprise environments. Unlike application software, extensions install silently through browser sync, update without user interaction, and in many organizations face no allowlist policy or inventory tracking. This campaign demonstrates that a previously safe extension can become a credential theft tool through a single ownership transfer, with no change to the extension's name, icon, or visible functionality.

The operational tradecraft here has direct parallels to supply chain backdoor implantation campaigns targeting trusted device firmware, where attackers exploit the same assumption that anything already approved and installed can be permanently trusted. The extension ecosystem simply has a lower barrier to ownership transfer than hardware firmware, making it a more accessible supply chain target for financially motivated actors who lack the resources to develop novel exploits.

The signed binary proxy execution technique used for googleupdate.exe is consistent with evasion approaches documented in advanced persistent threat groups deploying signed kernel components to bypass endpoint controls. Certificate-based trust is being systematically weaponized across multiple threat actor tiers, from commodity malware operations to state-sponsored APT groups.

For SOC teams, the detection gap is significant: most SIEM rules treat browser process network connections as expected behavior, and most EDR products do not alert on browser extension updates unless specific behavioral rules are configured. The Katzilla user agent and the C2 domain list from this post are the highest-signal indicators available today. Deploy the Sigma detection rule for proxy logs and the retrospective hunt queries covering the past 30 days before adding longer-term extension governance controls.