Topic
Malicious and repurposed browser add-ons, marketplace review limits, and update-time trust in extension ecosystems.
Socket confirmed 40 Firefox extensions as wallet stealers posing as OKX, Rabby and TronLink, with Supabase as a remote switch. Detection-first controls do not survive this pattern.
Reality
Socket found 19 Chrome and Edge extensions carrying crypto-draining code, five of them bought from their original owners. The malware landed in updates after each listing had earned real installs, which is exactly what a one-time vetting pass never re-checks.
Reality
Socket found that Twitch Enhanced Viewer | JeetBot attaches viewers' live OAuth tokens to playlist requests routed through its operator's proxies, exempting ten Russian-language channels. The Firefox fix has shipped and the Chrome build is in review.
Perspective Coverage
4 publishersReality
Gal Weizman showed that one malicious extension can take over the AI agents in Chrome, Comet, Edge, Neon and Claude in Chrome, with bounties from all five vendors to show for it. Installation is the only precondition.
Perspective Coverage
3 publishersReality
The add-on shipped to Mozilla's store as a dispatcher and took its instructions afterwards from a page it opened itself, on a domain built to resemble googleusercontent.com.
Reality
Elastic Security Labs describes a Brazilian banking operation that edits a Chrome or Edge profile and then signs its own edit using the OSCrypt and App-Bound keys sitting on the same machine. The browser loads the extension as approved.
Reality
Elastic Security Labs tied 1,515 infections, almost all in Brazil, to a loader that waits for Chrome to close and then writes its own extension into the profile directory with integrity hashes the browser accepts.
Reality
Forever Security showed the same technique working against Gemini in Chrome, Comet, Edge, Opera Neon and the Claude extension. Google and Microsoft have shipped fixes; the other three findings rest on the researchers' own account.
Reality
Elastic Security Labs says the Brazilian crew it calls REF9334 has been running this since at least May 2025, writing its extension into Chromium's Secure Preferences and reading C2 addresses out of an Ethereum smart contract.
Reality
Socket's threat researchers found that Twitch Enhanced Viewer sends each viewer's account-scoped OAuth token to a Russian bot vendor's proxies as a query parameter, on a redirect the extension's own code shows works without it.
Reality
Socket traced six Chrome and Firefox listings to one publisher operation whose collector reaches for Firebase access tokens and Axiom bundle keys. Chrome pulled four in July 2026. The Firefox one is still up.
Reality
The lure is a fake leaked vulnerability report promising 38% higher payouts to anyone greedy enough to paste the code. The command channel is a public Google Sheet that Talos reported twice and that stayed up.
Reality
Cisco Talos traces a crypto skimmer running since October 2025 that keeps persistence in a Tampermonkey userscript and pulls its code from a public Google Sheet. Talos says most organisations are not the target.
Reality
The human still taps the security key, and what crosses to the agent is one origin's cookies, normalized and pushed over 127.0.0.1. The identity provider sits on the relay's blocklist, which is the part worth copying.
Reality
Netskope Threat Labs puts the update between 20 and 31 July, and describes a Chrome sidebar that still earned an affiliate commission as users removed it. That says more about the update channel than about the install.
Reality
A missing origin check let any site pull an MSP's decrypted vault and keep access for up to 100 days, according to the researchers who found it. Installing the patch does not retire tokens already taken.
Reality
Apple Intelligence groups Safari tabs into topics and builds extensions from typed prompts. Five of Apple's eight sample prompts change the page itself; the guide says nothing about review or sharing.
Reality
Browser extensions update themselves silently unless new permissions are requested. Socket says it is now watching every version of every add-on in Mozilla's directory.
Reality
Socket says 40 of the 77 extensions it tracked are confirmed credential and wallet stealers, and nine of them were repurposed from sports-score shells under the same add-on IDs.
Reality