Malicious Chrome and Edge Extensions Deploy Modular Framework to Steal Crypto and Browser Data

What happened

BleepingComputer reports that multiple extensions distributed through the Chrome Web Store — and affecting Microsoft Edge as well — were found delivering a malware framework built around downloadable modules. According to the report, the framework's modules were used to steal cryptocurrency, harvest sensitive data and browser history, and inject ClickFix-style social-engineering lures into the browsing session. Full technical details, the number of extensions involved, and total install counts had not been independently verified by df00tech at time of writing.

Why it matters

Browser extensions typically run with broad permissions over page content, cookies, and stored data, and users tend to trust anything listed in an official store. A modular delivery framework is notable because it lets operators update or swap capabilities — credential theft, wallet draining, lure injection — after an extension is already installed, without needing a new store submission for each payload. Any organization that allows employees to install Chrome or Edge extensions, particularly those with crypto wallets or sensitive browsing activity, is potentially exposed.

What defenders should watch for

• Inventory installed browser extensions across managed endpoints and flag any with excessive permissions (host access to all sites, clipboard, or storage access) that aren't explicitly business-justified.
• Hunt for unexpected outbound connections initiated from browser processes to unfamiliar domains, especially around extension update/check-in intervals.
• Watch for ClickFix-pattern lures — prompts instructing users to copy/paste commands into Run dialogs or terminals — as these are a known delivery mechanism for follow-on payloads.
• Monitor for unusual clipboard activity or cryptocurrency wallet extension behavior that could indicate address-swapping or credential exfiltration.
• Where feasible, restrict extension installs to an admin-managed allowlist rather than permitting open installation from the Web Store.

Developing story

This is net-new, developing intelligence and is not yet mapped to a specific CVE or df00tech detection. Details may be updated as more information becomes available. Read the original report at BleepingComputer.