Browser-Extensions on CuraSec

19 Malicious Chrome/Edge Extensions Drain Crypto Wallets

Fri, 28 Aug 2026 21:21:40 +0000

Engineer — Plan: Audit managed Chrome and Edge extension allowlists against the 19 identified malicious extensions (details in the Socket/Hacker News report); enforce an extension allowlisting policy to block unapproved installs in managed browser deployments.
SOC/IR — Plan: Pull endpoint telemetry to hunt for these extension IDs across managed devices; build or tune a detection for novel extension installations that request broad permissions aligned with credential or clipboard access.
Leader — Learn: A coordinated six-month extension campaign highlights browser add-ons as a persistent supply-chain risk; useful context for reviewing whether your browser governance policy enforces an approved extension allowlist.

Thu, 20 Aug 2026 11:39:11 +0000

Engineer — Plan: If your org uses Web3 tooling or allows browser extensions in managed environments, audit installed Firefox extensions against the 77 flagged add-ons (OKX, Rabby Wallet, TronLink impersonators) and enforce extension allowlisting via policy.
SOC/IR — Plan: Build or tune detections for browser extension installs from unofficial sources in managed endpoints; hunt for any of the 77 flagged extensions identified by Socket in your EDR extension inventory.
Leader — Skip

Thu, 13 Aug 2026 11:57:16 +0000

Engineer — Plan: Audit any corporate-managed Chrome extensions against a blocklist of the 737 identified fakes; establish a policy requiring allowlisted extensions only for managed devices.
SOC/IR — Plan: Build detection for unusual SOCKS5 proxy egress from endpoints, and consider hunting for browser extension IDs associated with this campaign in endpoint telemetry.
Leader — Learn: Illustrates scale of Chrome Web Store supply-chain risk for enterprise endpoints; useful context for policy decisions around browser extension governance, but no immediate board-level action required.

Thu, 13 Aug 2026 11:57:16 +0000

Engineer — Plan: Extensions impersonating legitimate tools and silently proxying browser traffic is a real enterprise risk if employees install free VPNs on managed Chrome instances. Audit installed extensions across corporate devices and enforce an allowlist policy to block unapproved extensions.
SOC/IR — Learn: Browser extension-based traffic interception is a useful TTP to understand, but the summary provides no IOCs, C2 infrastructure details, or SIEM/EDR-actionable signals — primarily consumer-targeted with no immediate detection engineering opportunity.
Leader — Skip

Wed, 15 Jul 2026 12:11:39 +0000

Engineer — Learn: Research exposes a class of extension-level data leakage — wallet extensions correlating addresses and enabling cross-site tracking — worth considering when evaluating browser extension risk in enterprise environments or building wallet-adjacent tooling, but no patch or configuration action is available from this study.
SOC/IR — Skip
Leader — Skip