Superior Browser Extension Campaign — Wallet Drainer
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2VuJ1P…tqiMSummary
The 'Superior' campaign is a coordinated browser extension supply-chain attack identified by Socket Security in August 2026. Nineteen malicious Chrome and Edge extensions — collectively reaching approximately 80,000 users — deliver a multi-module malware framework capable of draining EVM, Solana, and Tron wallets, harvesting hardware-wallet seed phrases, and stealing credentials from major exchanges. The threat actor remains unidentified but has operated since at least February 2024, with confirmed infrastructure updates as recently as August 14, 2026.
Connected Entities
1 entities · 10 linked investigationsTimeline(5 events)
February 2024
Earliest infrastructure and code activity linked to the Superior campaign identified, based on similarities to activity documented by DomainTools.
Socket Security / CSO OnlineFebruary 2026
Approximate start of the six-month window in which the 19 malicious extension versions were published, per Socket Security's timeline.
Socket Security14 August 2026
After Chrome extension detected and removal initiated, threat actor publishes updated Edge extension version with a new C2 domain, confirming the campaign is actively adapting.
Socket Security27 August 2026
Socket Security publishes full public disclosure of the Superior campaign, naming 19 extensions, 16 malware modules, and associated C2 infrastructure. Chrome version reported as removed; Edge version reported as still live.
Socket Security27 August 2026
Coverage of the disclosure published by The Hacker News, Bleeping Computer, CSO Online, Cybersecurity News, GBHackers, Cyber Insider, and others.
The Hacker NewsDecision Log
- hash: mZPVpWGvqHrZhjyM7KpSprsdaWMA7bwxjTXkFMQbTEX
- hash: EsibPPB773eSQRtCPKVr9UwWF1UQCLCVJtzZf4ExKGxU
- hash: EKfxdNoDHYPBJGtW3bamC6dqS9RGVPrSiXuKuUtAF6pG
This investigation is cryptographically anchored to the Solana blockchain (3 events). 0 of 10 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/1/2026, 11:49:25 PM
last updated: 9/2/2026, 12:36:45 AM
avoid.net — verified advice for a post-truth world