Cybersecurity researchers have uncovered a campaign involving 19 crypto-stealing malicious browser extensions.

Socket said that the above-mentioned extensions (18 for Google Chrome and one for Microsoft Edge) were published or weaponized over the past six months. The security firm claims that the operation may date back to February 2024.

In some cases, attackers created extensions that initially appeared legitimate. In others, they acquired existing extensions from their original developers before making them malicious.

Of the 19 extensions identified by Socket, 14 were created by the threat actor, and five were purchased from legitimate authors.

“Enable Right Click & Copy — Smart Unlock + OCR” was the most dangerous extension. Socket…