Superior: Crypto and Credential Theft via Browser Extension Acquisition and Malicious Updates
Superior: Crypto and Credential Theft via Browser Extension Acquisition and Malicious Updates
Superior：通过收购浏览器扩展程序及恶意更新进行的加密货币与凭据窃取
1. Basic Information
1. 基本信息
Article Title: Chrome Web Store extensions caught stealing crypto, browser data 文章标题： Chrome 应用商店扩展程序被发现窃取加密货币及浏览器数据
Publisher: BleepingComputer 发布者： BleepingComputer
Publication Date: 2026-08-30 发布日期： 2026-08-30
Source: BleepingComputer 来源： BleepingComputer
Related Source: Socket Threat Research 相关来源： Socket Threat Research
Related Malware, Threat Groups, CVEs, and Products: Superior, Google Chrome, Microsoft Edge, Chrome Web Store, Microsoft Edge Add-ons 相关恶意软件、威胁组织、CVE 及产品： Superior, Google Chrome, Microsoft Edge, Chrome 应用商店, Microsoft Edge 加载项
Severity: High 严重程度： 高
2. Executive Summary
2. 执行摘要
Threat actors published custom or acquired Chrome and Edge extensions in a harmless state to build a user base before pushing malicious updates. After the update, the extensions received encrypted JavaScript modules from a command and control (C2) server, stripped Content Security Policy (CSP) headers from web pages, stole cryptocurrency wallets, credentials, session data, and browsing history, and displayed ClickFix-style fake update prompts. 威胁行为者发布自定义或收购的 Chrome 和 Edge 扩展程序，在保持无害状态以积累用户群后，再推送恶意更新。更新后，这些扩展程序会从命令与控制 (C2) 服务器接收加密的 JavaScript 模块，剥离网页的内容安全策略 (CSP) 标头，窃取加密货币钱包、凭据、会话数据和浏览历史记录，并显示 ClickFix 风格的虚假更新提示。
3. Attack Flow
3. 攻击流程
Distribution via Abused Extension Trust 通过滥用扩展程序信任进行分发
Threat actors publish a harmless extension with practical features or acquire an existing extension with an established user base from its original author. Users install the extension, and the browser automatically updates it to newer versions by default. Threat actors publish a new version containing malicious code and distribute it to existing users. The change in extension ownership is not explicitly notified to users. 威胁行为者发布具有实用功能的无害扩展程序，或从原作者手中收购拥有既定用户群的现有扩展程序。用户安装该扩展程序后，浏览器默认会自动将其更新到新版本。威胁行为者发布包含恶意代码的新版本并分发给现有用户。扩展程序所有权的变更不会明确通知用户。
Module Retrieval and In-Page Execution 模块检索与页面内执行
The background service worker generates a unique installation UUID and establishes a WebSocket connection with the C2 server. The extension stores the JavaScript modules received from the C2 server in chrome.storage.local encrypted with AES-GCM, using a key derived from the extension ID and installation UUID. The extension registers dynamic declarativeNetRequest rules to strip Content-Security-Policy response headers from browsed pages. Content scripts set the malicious code as an event handler on a hidden DOM element, trigger the event, and execute the code in the main world of the web page. Depending on the target site and user activity, the extension intercepts wallet operations, steals recovery phrases, obtains credentials and session tokens, transmits browsing history, or initiates ClickFix redirection.
后台服务工作线程 (Service Worker) 会生成唯一的安装 UUID，并与 C2 服务器建立 WebSocket 连接。扩展程序将从 C2 服务器接收到的 JavaScript 模块以 AES-GCM 加密方式存储在 chrome.storage.local 中，并使用从扩展程序 ID 和安装 UUID 派生的密钥。扩展程序注册动态 declarativeNetRequest 规则，以剥离所浏览页面的内容安全策略 (CSP) 响应标头。内容脚本将恶意代码设置为隐藏 DOM 元素上的事件处理程序，触发该事件，并在网页的主世界 (Main World) 中执行代码。根据目标站点和用户活动，扩展程序会拦截钱包操作、窃取恢复短语、获取凭据和会话令牌、传输浏览历史记录或发起 ClickFix 重定向。
4. Threat Actor Positioning and Execution Locations
4. 威胁行为者定位与执行位置
Threat actors control store update channels and C2 infrastructure as the publishers or post-acquisition owners of the browser extensions. The loader runs in the background service worker of the extension, and the retrieved modules execute in the main world of the web page viewed by the user. If a ClickFix attack succeeds, the commands pasted and executed by the user run locally on the device. 威胁行为者作为浏览器扩展程序的发布者或收购后的所有者，控制着商店更新渠道和 C2 基础设施。加载程序在扩展程序的后台服务工作线程中运行，检索到的模块在用户查看的网页主世界中执行。如果 ClickFix 攻击成功，用户粘贴并执行的命令将在设备本地运行。
5. Visibility for Victims and Administrators
5. 受害者与管理员的可见性
Victims 受害者
Normal extensions used previously update automatically, often without any new installation prompts or clear warnings. Full-screen update and recovery pages resembling legitimate interfaces appear on official Ledger or Trezor sites, requesting 12-, 18-, or 24-word recovery phrases. Clicking legitimate Connect Wallet or Swap buttons redirects users to processes swapped out by the attacker. Fake Chrome update prompts may guide users to copy and execute commands on their devices via the clipboard. 之前使用的正常扩展程序会自动更新，通常没有任何新的安装提示或明确警告。在 Ledger 或 Trezor 的官方网站上会出现类似于合法界面的全屏更新和恢复页面，要求输入 12、18 或 24 个单词的恢复短语。点击合法的“连接钱包”或“兑换”按钮会将用户重定向到攻击者替换的流程。虚假的 Chrome 更新提示可能会引导用户通过剪贴板在设备上复制并执行命令。
Administrators 管理员
Managed browsers contain known malicious extension IDs or unnecessary extensions with high privileges. WebSocket or HTTPS traffic originates from extension processes to C2 servers or Cloudflare Workers using domains such as .top, .pro, and .sbs. When ClickFix succeeds, shell or script execution environments launch immediately after the browser process. Identity providers (IdPs) or cryptocurrency services may exhibit reused existing sessions, operations from unusual sources and devices, and asset transfers. 受管浏览器中包含已知的恶意扩展程序 ID 或具有高权限的不必要扩展程序。WebSocket 或 HTTPS 流量源自扩展程序进程，并指向使用 .top、.pro 和 .sbs 等域名的 C2 服务器或 Cloudflare Workers。当 ClickFix 攻击成功时，Shell 或脚本执行环境会在浏览器进程之后立即启动。身份提供商 (IdP) 或加密货币服务可能会显示重复使用的现有会话、来自异常来源和设备的各种操作以及资产转移。
6. Success and Failure Conditions
6. 成功与失败条件
Success Conditions 成功条件
A user has installed or automatically updated to the malicious version of one of the 19 targeted extensions. The extension successfully reaches the C2 server and receives the JavaScript module appropriate for the target. For credential or session theft, the user has opened the target page and is in an input or logged-in state. For recovery phrase theft, wallet asset transfers, and command execution via ClickFix, the user follows the instructions or approval prompts on the fake interface. 用户已安装或自动更新到 19 个目标扩展程序之一的恶意版本。扩展程序成功连接到 C2 服务器并接收到针对该目标的 JavaScript 模块。对于凭据或会话窃取，用户需打开目标页面并处于输入或登录状态。对于恢复短语窃取、钱包资产转移以及通过 ClickFix 执行命令，用户需按照虚假界面上的说明或批准提示进行操作。
Failure Conditions / Risk Mitigation 失败条件 / 风险缓解
Remove and block known malicious extension IDs and eliminate unnecessary extensions from managed browsers. Enforce an allowlist policy for extensions in enterprise environments and continuously monitor ownership and permission changes. Block DNS, WebSocket, and HTTPS traffic to the listed C2 servers, secondary distribution sites, and data exfiltration destinations. Educate users not to follow ClickFix instructions to paste commands, and use Endpoint Detection and Response (EDR) to control behaviors where shells spawn from browsers. 移除并阻止已知的恶意扩展程序 ID，并从受管浏览器中清除不必要的扩展程序。在企业环境中强制执行扩展程序白名单策略，并持续监控所有权和权限变更。阻止指向所列 C2 服务器、二级分发站点和数据外泄目的地的 DNS、WebSocket 和 HTTPS 流量。教育用户不要遵循 ClickFix 的指令粘贴命令，并使用端点检测与响应 (EDR) 来控制浏览器衍生出 Shell 的行为。
7. What Happens Upon Successful Exploitation
7. 成功利用后的后果
Connection and swap operations for EVM, Solana, and Tron wallets are hijacked, tricking users into approving asset transfers to the attacker. Ledger and Trezor recovery phrases are stolen, compromising the entire corresponding wallet. Sessions, tokens, account details, and balance information for Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit, and MetaMask are acquired. Usernames, passwords, email addresses, and form input values are harvested from input fields on arbitrary sites. Facebook and LinkedIn account information and browser history are transmitted. Successful ClickFix fake update redirection leads to command execution outside the browser on the device. EVM、Solana 和 Tron 钱包的连接和兑换操作被劫持，诱骗用户批准向攻击者转移资产。Ledger 和 Trezor 的恢复短语被窃取，导致整个相关钱包被攻破。Coinbase、Binance、Kraken、OKX、MEXC、KuCoin、Bybit 和 MetaMask 的会话、令牌、账户详情和余额信息被获取。用户名、密码、电子邮件地址和表单输入值从任意站点的输入字段中被采集。Facebook 和 LinkedIn 的账户信息及浏览器历史记录被传输。成功的 ClickFix 虚假更新重定向会导致在设备浏览器之外执行命令。
8. Observable Logs
8. 可观测日志
Email: Not the primary distribution vector for this incident. Review contemporaneous emails and chat URLs only if an alternative vector leading to ClickFix is suspected. 电子邮件： 不是本次事件的主要分发媒介。仅在怀疑存在导致 ClickFix 的替代媒介时，才审查同期电子邮件和聊天 URL。
Proxy/SWG/DNS: DNS, WebSocket, and HTTPS traffic to domains such as active-enable-right-click[.]top, api[.]enable-right-click[.]click, payload[.]siteinsight[.]bond, api[.]extensionanalyticspro[.]top, ws[.]site-signal[.]top, content[.]resonanceweb[.]top, lucky-ra 代理/SWG/DNS： 指向 active-enable-right-click[.]top、api[.]enable-right-click[.]click、payload[.]siteinsight[.]bond、api[.]extensionanalyticspro[.]top、ws[.]site-signal[.]top、content[.]resonanceweb[.]top、lucky-ra 等域名的 DNS、WebSocket 和 HTTPS 流量。