Socket: 18 Malicious Microsoft Edge Extensions Found

What it is

Socket's threat research on a browser-extension malware campaign, published alongside their announcement of Edge Add-ons coverage. The named artifact of interest is the extension "Enable Right Click & Copy — Smart Unlock + OCR", one of five listings purchased from legitimate developers and later weaponized. It had ~70,000 Chrome users when malicious code appeared; a version carrying the same malware had another ~10,000 users on Edge, for a combined potential exposure of ~80,000.

How it works

Two distribution paths converge on Edge users. Edge runs Chromium extension APIs, so the same code runs in both browsers, and Edge lets users install from the Chrome Web Store in addition to Microsoft Edge Add-ons — so two employees may hold the "same" tool under different extension IDs, publishers, and update histories. The attack vector is ownership transfer: buying an extension buys its existing install base and permissions, and updates ship silently to users who already trust it. On the technical side, the malicious Edge extension strips Content Security Policy headers from visited pages, holds a persistent WebSocket connection to attacker infrastructure, and executes modules delivered remotely by the C2 server — behavior a manifest/permissions review alone does not reveal.

Preconditions / Affected

Enterprises running Edge where users can self-install extensions from either store. A takedown in one store does not resolve the risk in the other: the Chrome listing was removed, but the Edge version stayed live and serving malware, and on August 14, 2026 the attackers pushed an Edge update with a new C2 domain — evading the Chrome-side intervention entirely.

What to do

• Hunt for the named extension across both stores and by behavior, not by a single ID — the same tool exists under different Edge Add-ons and Chrome Web Store identities.
• Do not treat a Chrome takedown as remediation for Edge; verify the Edge listing/version separately.
• Use Microsoft's Edge admin policies (allow / block / force-install) to constrain which extensions run, but note these gate approval only.
• Add continuous post-approval review: the version reviewed months ago may differ from what runs today. Watch for new C2 domains appearing in updates, CSP-header stripping, and persistent WebSocket connections.

Caveats

The ~80,000 figure is potential exposure across the two listings — the page states this does not mean every user installed the malicious version. Microsoft's Edge Add-ons policies already prohibit malware, phishing, obfuscated code, and unauthorized remote scripts; the active malicious listing shows those policies were an insufficient baseline on their own. The bulk of the page is a Socket product announcement for Edge coverage.