Security researchers at Socket have identified 19 browser extensions for Chrome and Edge that were silently stealing passwords, cryptocurrency, and browsing history from users — some for over two years.

Five of the extensions were originally legitimate tools that were purchased from their developers and then injected with malware through automatic updates. One — “Enable Right Click & Copy” — had more than 80,000 users across Chrome and Edge when it turned malicious. The extensions could drain crypto wallets, replace hardware wallet sites like Ledger and Trezor with phishing pages, steal login credentials entered on every website visited, and harvest account data from Facebook and LinkedIn. Some also injected fake browser update prompts to trick users into running attacker commands.

Why this matters for Australian businesses: Browser extensions sit in a security blind spot. Most SMBs working through the Essential Eight focus on patching, MFA, and application control for installed software — but browser extensions bypass traditional application whitelisting because they run inside an already-approved app. In our client environments, we regularly find unvetted extensions installed by staff who added a productivity tool without thinking twice. If your team uses Chrome or Edge (and almost everyone does), this affects you.

Google has removed the malicious extensions from the Chrome Web Store, but at the time of reporting, several remained available on the Microsoft Edge Add-ons store.

What to Do Now

Open chrome://extensions (or edge://extensions) and review every installed extension. Remove anything you don’t actively use or don’t recognise. If you had any of the listed extensions, change your passwords immediately. Consider enforcing a browser extension policy through Microsoft Intune or Google Workspace admin to prevent unapproved installs going forward.

Need help locking down your browser environment? Talk to the All IT cybersecurity team.