According to CoinMeta, security research firm Socket has discovered 19 malicious browser extensions, including 18 Chrome extensions and 1 Edge extension. These extensions can distribute malicious modules remotely to steal private information from encrypted wallets, mnemonic phrases, exchange login credentials, and browser data, as well as to carry out wallet asset theft. The extensions typically establish a user base with legitimate functions before adding malicious code through updates. Five of these extensions were acquired by attackers from the original developers and then modified to include malicious functionality. The most affected extensions, " enable right click & copy smart unlock + ocr ", affected approximately 80,000 users on Chrome and Edge. Versions of these extensions that contained the malicious code have been removed from the market, but as of the time of this report, versions still distributing the malicious code were still in use. Socket categorized this activity as a " superior " attack campaign, which can be traced back to February 2024.