Socket: "Superior" Campaign

What it is

Socket's writeup of the "Superior" campaign — 18 Chrome and 1 Edge extension carrying a shared, modular wallet-drainer / credential-stealing framework, linked by code and technique similarities to a campaign DomainTools first reported in February 2024 and Secure Annex later investigated. The malicious versions were all published within the last six months.

How it works

Every extension follows the same pattern: the first published version is clean and delivers its advertised utility; once a trust base exists, a later version introduces the malicious code. The background service worker opens a persistent WebSocket C2 channel with a 5-minute heartbeat, silently swallowing all errors. It downloads code modules ("nodes"), performs CSP stripping, and abuses XSS injection to execute those payloads. Both the C2 endpoint and the data-exfiltration endpoint can be rotated per victim via instructions from the initial C2 — observed in the wild — letting the actor segment victims across dedicated infrastructure and lower detection risk.

Preconditions / Affected

The 19 extensions split into 14 actor-created and 5 bought from legitimate authors; utility categories include SEO stats checkers, crypto price monitors, screen search utilities, and ad-spying tools. Exposure is amplified because Chrome defaults to auto-updating extensions at startup and every few hours, so trusted installs silently pull the weaponized version. The highest-impact extension, "Enable Right Click & Copy — Smart Unlock + OCR" (originally from PreppHint), had ~70,000 Chrome users when the malicious version shipped plus ~10,000 on Edge — ~80,000 combined.

What to do

The concrete detection value the summary omits — hunt for these campaign-wide signatures:

• WebSocket C2 URLs whose query parameters are identical across the campaign even though the domain differs per extension:

wss://<c2-domain>/?uuid=${uuid}&extension=${extension.runtime.id}

• Known C2 domain (defanged): active-enable-right-click[.]top
• chrome.storage.local keys used for job orchestration: user-identifier, deployed, latest-interaction, inactivity-limit, nodes, welcome-shown, analytics-consent
• The userId is a crypto.randomUUID() persisted in local storage; heartbeat/ping interval is 25000 ms (documented as "5-minute" in prose).

If "Enable Right Click & Copy — Smart Unlock + OCR" is installed on Edge, treat it as live malware: at the time of writing the Chrome version was removed from the Web Store, but the Edge version remained active and, after the Chrome takedown, shipped a new C2 domain on August 14th, 2026. Reported to the Edge store but not yet removed.

Caveats

Socket notes the ~70,000 figure is the extension's user count when the malicious version was introduced, not confirmation that all those users received it. The framework is pluggable, so the final payload "likely changes over time" — current focus is wallet-secret theft and crypto draining, but capabilities are "not limited to" that.