Browser extensions turn into supply chain risk

Attackers have found a way to turn a browser extension users already trust into a vector for malware, according to researchers at Socket. The campaign, which targeted Chrome and Edge extensions, shows how a previously safe tool can become a threat after a change in ownership, with malicious updates reaching users who thought they were running software they had already vetted.

19 extensions, two paths to infection

Socket's investigation identified 19 extensions for Google Chrome and Microsoft Edge involved in the campaign. Of those, five had originally been built by legitimate publishers and were later acquired by the attackers. The other 14 were created by the threat actor but were released without malware initially, a tactic that let them build a user base before turning malicious.

This two-pronged approach highlights a problem that is hard for users and companies to spot: an extension that appears safe when first installed can change after an ownership transfer or a software update. Existing users have little reason to revisit an earlier decision to trust it, especially when the update process happens automatically.

Automatic updates hide the threat

Chrome's extension update mechanism compounds the risk. Installed extensions are normally updated automatically, meaning malicious code added to a later release can reach users without requiring them to download another application or reinstall the extension. The user simply gets the updated version, unaware that it now contains something harmful.

Socket examined one extension, called Enable Right Click & Copy — Smart Unlock + OCR, which had about 70,000 users when the malicious code was added. The extension had initially been developed by PreppHint before being acquired by the threat actor. A related Edge extension had about 10,000 users. Socket said those numbers indicate the possible reach of the malware, rather than confirming that every user received an infected version.

What the malware could do

Once installed, the malware could contact attacker-controlled infrastructure and receive additional JavaScript payloads. Socket found that it could remove Content Security Policy headers from websites opened in the browser, clearing the way for attacker-supplied code to run inside pages visited by the user.

The campaign was heavily focused on cryptocurrency theft, but its capabilities went further. Socket observed code that captured information typed into web forms and extracted authentication material from active browser sessions. Other modules targeted logged-in social media accounts and collected browser history.

The researchers linked the extensions to a broader operation dating to February 2024, based on similarities with activity previously documented by DomainTools. The malware's design allowed attackers to change the payloads delivered to infected browsers over time, meaning the threat could evolve even after an extension was flagged.

Extensions become supply-chain risks

The campaign shows why companies can no longer treat approval of a browser extension as a one-time security decision, according to Keith Prabhu, founder and CEO of Confidis. He said that security teams need to think of extensions as software that changes over time, not as static tools.

“CISOs should treat browser extensions as continuously changing third-party software, not as static productivity tools. Organizations should move from ‘install approval’ to ‘lifecycle assurance’ for browser extensions.”

— Keith Prabhu, founder and CEO of Confidis

Prabhu suggested that security teams may need to reassess extensions after deployment, particularly when ownership changes or new versions request broader permissions. Changes to code and publisher identity can provide early warning that an extension no longer carries the same risk profile it had when first approved.

Parallels to mobile app attacks

Jonathan Ong, senior analyst for managed security services at Omdia, compared the tactic to attacks involving malicious mobile applications, where a clean initial version is used to gain approval before harmful code is introduced in a later update. The similarity suggests that approval by an official software marketplace should not be treated as a lasting indicator of safety once an application or extension begins receiving updates.

Prabhu also recommended restricting extension access to sensitive corporate sites and monitoring the network connections and data activity generated by extensions.

Browser visibility remains limited

The attack also exposes a visibility problem for enterprise security teams. Tools already deployed across endpoints and networks may detect parts of an attack without necessarily seeing what a malicious extension is doing inside the browser.

Prabhu noted that existing controls, while valuable, do not provide reliable visibility into extension-level activity. He said that none of these controls, by themselves, offer a clear view of what an extension does inside a page.

That gap makes browser telemetry more important in environments where employees rely heavily on extensions, particularly when malicious behavior takes place inside authenticated sessions rather than through a conventional executable running on the endpoint.

MDR services could help close that gap by incorporating browser telemetry into their monitoring, Ong said. That could allow defenders to look for unusual extension behavior, such as attempts to remove CSP protections or establish WebSocket connections with previously untrusted domains.

Response requires containment

Prabhu recommended determining when the malicious version was present on affected systems, revoking active sessions and refresh tokens, and rotating credentials or other secrets that may have been exposed. Incident responders should also examine browser, network, identity, and SaaS logs for signs of account misuse or unauthorized data access.

The investigation may also need to establish what information the extension was able to access, particularly if sensitive corporate or personal data was exposed. Ong added that some MDR providers can help organizations determine the extent of data exposure following such an incident. That assessment can help enterprises understand whether the compromise may trigger breach notification or other regulatory requirements in the jurisdictions where they operate.

Why it matters

The discovery suggests that browser extensions have become a more dangerous attack surface than many organizations realize. When a trusted extension can be weaponized through an acquisition and then updated automatically, the usual assumptions about software supply chains — that a marketplaces' approval or a user's initial decision to install is enough — start to break down. This could mean that security teams need to treat every extension like a live, evolving system, constantly reassessing what it is allowed to do and what it is connecting to. For businesses, the cost of ignoring that shift could be a breach that originates in a tool employees thought was safe.