CyberNew CyberNew
Ransomware & Malware BleepingComputer 1 month ago

Chrome Web Store extensions caught stealing crypto, browser data

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, and to inject ClickFix lures. Researchers say all 19 malicious modules uncovered in the campaign serve distinct purposes and are designed to be "highly extensible." The operation was uncovered by application security company..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Chrome Web Store extensions caught stealing crypto, browser data

Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, and to inject ClickFix lures.

Researchers say all 19 malicious modules uncovered in the campaign serve distinct purposes and are designed to be "highly extensible."

The operation was uncovered by application security company Socket, and the investigation indicates that it may have been active since early 2024.

image
Extension ID Extension Name
pkoccklolohdacbfooifnpebakpbeipc Enable Right Click & Copy — Smart Unlock + OCR
fegckejpfnlmfgkfjpinlbgmeeijjkel RapidLens - Google Lens for Screen Search & Images
kdenlnncndfnhkognokgfpabgkgehodd QuickLens - Search Screen with Google Lens
jamminefolhgepgihbmcjjhgldbfcikp Password Protect PDF
inmkjedjdhgpknjogbjomhnbgdccckkg Allow Copy - Select & Enable Right Click (Edge extension)
fcgdejjichpgfaaafflplhfijcnieopb PixelCheck
cfpnjdbpojpcongfaefcamjbaolpelcd Creative Library - Ad Spy Tool
aapdalkmclfaahehnmicbglkohkldhne Website Traffic Checker: MirrorSphere SEO Stats
dkdadldmiefjldmegbjbnhhfddnkhlhm Site Signal - Website Traffic & SEO Checker
fjmlhlkccegopebcllcmafahkmeejpph SEO Pulse Pro - Website Traffic & SEO Analyzer
iekoapohahgmogbagegmcgplbkikcgke Private Crypto News Reader
ahpnnnjbnfbhoikhohglpohnoocjcoco  Blockfolio: Address Monitor
oeacadlaclegkkkdehjmiifnjhcekclj Crypto Rates & Fiat Converter
jmlgannjlbliikgcaieomgmcnfplglea Crypto Alerter: Price Alarms & Volatility Warnings
lhmcajhgadanidbopgaoobjlldegjmke DeFi Pulse Tracker
gfackggoapepdmnjnkblogdcjpgcjiak Crypto Price Badge: Quick Glance
hfijkbdkpidafdbeebnnkhfccildbcle Multi-Chain Explorer
pcngchfbfgejllcbhmeadjhiebebiome LedgerLook: Wallet Checker
aodkjdeghbjiaienipfjkbpcikkacbcp Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Ray
Get the report

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →