GoKawiilMalicious Chrome and Edge extensions hijacked to steal crypto wallets, browser data
Security firm Socket uncovered a campaign, active since early 2024, in which 16 malware modules were pushed through browser extensions on the Chrome Web Store and Microsoft Edge add-ons store. Five extensions were initially legitimate but were bought from their original developers and later turned malicious via automatic updates, including one tool with roughly 70,000 Chrome users and 10,000 Edge users. Once activated, the extensions connected to remote servers to strip website security headers, inject phishing scripts, and drain cryptocurrency wallets on platforms like Coinbase, Binance, Kraken and MetaMask.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how attackers can bypass app-store vetting by acquiring trusted extensions with large install bases rather than building malware from scratch, making detection far harder. It also highlights a gap in enforcement: Google pulled the offending extension quickly, but Microsoft's Edge store still hosted it after disclosure, exposing thousands of users to ongoing crypto theft.
- Attackers bought legitimate extensions and weaponized them through routine software updates.
- At least one extension with 70,000+ Chrome and 10,000 Edge users was compromised.
- The malware targeted major crypto exchanges and wallets, including Coinbase, Binance and MetaMask.
Ledger Nano X Hardware Wallet — When browser extensions can quietly siphon crypto, keeping your keys off the computer entirely is the strongest defense. The Ledger Nano X stores private keys on a dedicated device and requires physical confirmation on-device before any transaction goes through, so a compromised Chrome add-on can't move your funds on its own.
See Ledger Nano X Hardware Wallet on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-30
Published there as: “Chrome Web Store extensions caught stealing crypto, browser data”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.