Multiple extensions for Google Chrome and Microsoft Edge have been caught delivering a malware framework that steals cryptocurrency, sensitive data, and browser history, according to a report published on 2026-08-30 by BleepingComputer. The extensions also injected ClickFix lures, a social engineering technique that tricks users into executing malicious code.
The report did not name the specific extensions or provide a count, but it said the malware framework deployed modules to perform the theft. The extensions were available on the Chrome Web Store, which also serves Microsoft Edge, as Edge can install Chrome extensions.
Malware framework with multiple modules
The malware framework was designed to be modular, with separate components for stealing cryptocurrency, sensitive data, and browser history. It also included a module to inject ClickFix lures, which typically display fake error messages or prompts that urge users to copy and run a command, leading to infection.
BleepingComputer's report did not detail how the extensions were distributed or how many users were affected. It also did not specify whether the extensions have been removed from the stores.
Impact on Chrome and Edge users
Because the extensions were available on the Chrome Web Store, they could be installed by both Google Chrome and Microsoft Edge users. The report did not indicate whether the extensions were also available on other Chromium-based browsers.
The theft of browser history and sensitive data could expose users to further attacks, such as credential stuffing or identity theft. The cryptocurrency theft suggests the attackers targeted users with digital wallets.
What happens next
The report leaves open the question of whether the extensions have been taken down and whether Google or Microsoft have issued any warnings. Users who have installed extensions from the Chrome Web Store are advised to review their installed extensions and remove any that are suspicious. The full scope of the campaign, including the number of affected users and the identities of the extensions, remains unknown.