Behavioral Risk Brief: Crypto Stealing Chrome Extension
The Claim
Governance frameworks that treat an extension’s installation history and prior clean behavior as ongoing proof of safety create systemic risk when that same history can be inherited by a new owner or preserved deliberately before a compromise. Zero Trust for Code addresses this by requiring a pre-execution trust decision on what an extension does at the moment it runs, rather than trust based on how long it has behaved.
The Incident
Researchers identified a cluster of Chrome and Edge browser extensions delivering a modular malware framework designed to steal cryptocurrency, browser session data, and login credentials, while also displaying fake browser update prompts that trick users into running attacker-supplied commands. All of the affected extensions provided their advertised functionality and contained no malicious code when originally published, either acquired by the attacker from an original developer or left clean long enough to accumulate a genuine user base before malicious functionality arrived through a routine, automatic update. Once active, the malware opens an encrypted connection to attacker-controlled infrastructure and downloads additional modules, exploiting legitimate wallet-connection features on cryptocurrency platforms and redirecting users to counterfeit versions of trusted hardware wallet services.
The Governance Failure
The governance failure is not that malicious extensions reached an official marketplace, but that trust in these extensions was earned legitimately. Through real functionality, a genuine track record, and before being used against the same users who granted it. An extension that behaves correctly for an extended period builds exactly the kind of history an organization would typically treat as evidence of safety, and this campaign shows that history can be preserved deliberately or transferred entirely to a new owner without resetting.
This is compounded by how automatic updates function as the delivery mechanism for the compromise. Once a user installs an extension and grants it permissions, updates are typically applied without renewed scrutiny. Since the extension is already trusted and the update is assumed to be a continuation of the same, previously reviewed behavior. That assumption is precisely what this campaign relies on, since the update itself is the point at which trust and actual behavior diverge.
The underlying breakdown is the absence of a trust decision that re-evaluates behavior at every update, rather than extending trust indefinitely from an extension’s initial review and accumulated history. Ownership itself can also change hands entirely, meaning the entity a user or organization implicitly trusted when installing an extension may no longer be the entity controlling it later. As long as installation history and past behavior are treated as sufficient going forward, an attacker who can wait, acquire, or preserve that history inherits the trust it built.
The Regulatory and Business Exposure
- Credential and cryptocurrency wallet theft carried out through extensions with a genuine history of safe, advertised functionality.
- Malicious behavior delivered through automatic updates, a channel typically exempt from renewed scrutiny.
- Extension ownership transferred to a new party without resetting the trust a prior owner had earned.
What Your Auditors Will Ask
- How do you validate what an extension update does, independent of the extension’s prior clean history?
- What controls detect a change in ownership or control of an extension already installed across your organization?
- How do you account for malicious behavior introduced only after an extension has accumulated a genuine user base?
- What evidence do you maintain that extension behavior was assessed at each update, not only at initial installation?
- How do you verify that automatic update channels are not treated as inherently trusted simply because the original extension was reviewed?
A consistent signal is the disconnect between an extension’s accumulated history and what it does at the moment an update actually runs. A genuine track record of safe behavior says nothing about who controls that extension now or what its next update will do
Zero Trust for Code Value
Zero Trust for Code introduces a trust decision at the point an extension actually executes, evaluating its behavior at every update rather than extending trust indefinitely based on installation history or past behavior. This means an extension earns permission to run based on what its current version does, regardless of how long it has operated safely or who originally published it.
This directly addresses the governance weakness exposed by this campaign: the assumption that an extension’s accumulated history and prior legitimate functionality remain valid indicators of safety after ownership changes or an update is pushed. By requiring a pre-execution trust decision independent of history, organizations can evaluate what an update actually does even when the extension delivering it has behaved correctly for a substantial period beforehand.
The result is a governance model where trust is re-established at every execution rather than inherited from the past. This closes the space this campaign relied on when it built genuine history specifically to spend it later.
Governance Action Brief
- Establish governance controls that evaluate extension behavior independently of installation history or prior clean performance.
- Require a pre-execution trust decision for extension updates, not only for initial installation.
- Treat a change in extension ownership or publisher identity as requiring renewed scrutiny, not continuity of prior trust.
- Monitor for extensions establishing outbound connections to infrastructure unrelated to their advertised function.
- Maintain a record of extension behavior evaluated at each update, separate from the extension’s accumulated history.
Sources
Analysis based on original research from Socket (Karlo Zanki) on the Superior Chrome and Edge extension campaign, with reporting from The Hacker News and BleepingComputer and
CodeHunter Labs
