Multiple browser extensions on the Chrome Web Store and Microsoft Edge add-ons marketplace deployed a malware framework to steal cryptocurrency, sensitive data, and browser history, according to application security company Socket. The investigation indicates the operation may have been active since early 2024.

Socket said five of the extensions were acquired from their original creators and injected with malware via automatic updates. One extension, named "Enable Right Click & Copy — Smart Unlock + OCR," had at least 70,000 Chrome users and 10,000 Edge users when it turned malicious, Bill Toulas reports for BleepingComputer.