Chrome and Edge: Remove 19 Extensions Linked to ClickFix

Kaspersky’s September 17 write-up draws on Socket’s August 27 investigation, which found 18 malicious Chrome extensions and one Microsoft Edge extension using closely related code and operating methods. BleepingComputer independently reported the campaign on August 30, including Socket’s finding that five extensions had been bought from their original developers and later weaponized through routine updates. The important point for Windows users is that a store-installed extension can become dangerous after it has earned trust—and may update silently before anyone notices.

The largest identified exposure was Enable Right Click & Copy — Smart Unlock + OCR, a formerly legitimate utility that Socket says had about 70,000 Chrome users when malicious behavior was introduced, alongside an Edge version with roughly 10,000 users. Those install figures are an exposure estimate, not evidence that every user received or executed the malicious payload. Neither Socket nor Kaspersky has published a victim count, a complete timeline for each bad version, or evidence that every installed copy ran the same modules.

Still, this is a useful reminder that browser extensions belong in the endpoint-security conversation. An add-on permitted to read and change data on every site can alter what a user sees on a banking portal, a Microsoft 365 sign-in page, a crypto exchange, or an internal business application—without compromising the website itself.

The browser is the delivery mechanism​

Socket tracks the operation as “Superior,” based on labels found in its JavaScript modules, and says its technical links to earlier research point to activity going back to February 2024. The 19 extensions first behaved as advertised, Socket found. Later releases added the shared malware framework, either after the operator built up a user base or, in five cases, after the operator acquired an existing extension.

The framework reportedly opens a persistent connection to attacker-controlled infrastructure, retrieves additional JavaScript modules, and injects those modules into pages visited by the user. Its most consequential feature is the ability to remove a site’s Content Security Policy restrictions for the affected browser session. Content Security Policy is a browser control used by website operators to limit which scripts may run on their pages; it is a valuable web defense, but it cannot protect a user from a locally installed extension that has been granted broad permission to modify page content.

That is why this campaign is more serious than an unwanted toolbar or a nuisance ad injector. According to Socket and BleepingComputer, observed modules recorded form entries and credentials, collected browser history and social-media data, harvested account or session information from crypto services, and replaced wallet-related controls with attacker-controlled versions. The same delivery framework can receive new modules, meaning the behavior of a compromised extension is not fixed at the moment an administrator or user initially inspects it.

The purchase-and-update route is also the hard part to defend against with a one-time vetting process. An extension may have a reasonable purpose, positive reviews, and a history in an official store when it is approved. A change in ownership and a later automatic update can change the risk profile overnight, while the extension retains permissions granted months or years earlier.

ClickFix turns a browser compromise into a Windows compromise​

The campaign’s ClickFix module carries the clearest Windows consequence. ClickFix is a social-engineering technique in which a webpage presents fake instructions—often framed as a CAPTCHA, browser repair, security validation, or required update—and persuades a user to copy and run a command themselves.

Socket described a fake “Chrome — Update available” page that copies an attacker-provided command to the clipboard and gives operating-system-specific instructions for pasting and executing it. Kaspersky highlighted the same progression: an extension modifies content on a real site, then uses the fake update notice to coax the user beyond the browser’s security boundary.

The deception works because it begins on a page the victim intended to visit. A user may correctly recognize a familiar website but have no reason to suspect that its visible content is being altered only in their own browser. The web server, DNS record, certificate, and page seen by other visitors can all remain legitimate.

Removing the extension is necessary, but it may not be sufficient. If the user only saw a suspicious overlay and did not run a command, the immediate priority is removing the extension and treating passwords, active sessions, and browser-stored data as potentially exposed. If the user copied and executed the proposed command in PowerShell, Command Prompt, the Run dialog, Windows Terminal, or another system tool, the incident needs endpoint investigation: the malicious activity may already have persisted outside Chrome or Edge.

For an organization, that distinction changes the response. A browser-extension cleanup is an application-control problem. A confirmed ClickFix execution is a potential malware incident that warrants isolating the device as appropriate, preserving relevant evidence, reviewing identity activity, and following the organization’s incident-response process. Reinstalling the add-on is never an acceptable “fix,” even if a later version appears clean.

The affected extension IDs are the practical indicator​

Names alone are not reliable enough for an enterprise block rule: developers can alter a store listing’s title, and similarly named extensions may be unrelated. Socket’s research, republished by BleepingComputer, supplied the extension IDs administrators need for a targeted inventory and block operation.

For individual users, Chrome and Edge both expose installed add-ons through their Extensions settings. Check every browser profile, including personal profiles used on a work PC. Remove any matching item, then review other extensions with broad “read and change data” access—especially those allowed on all sites but used rarely or no longer needed.

Anyone who had an affected extension should change passwords for important accounts from a known-clean device, revoke active sessions where the provider supports it, and review sign-in activity for email, password managers, financial services, work accounts, social networks, and crypto exchanges. Wallet users should treat any seed phrase entered into a browser page as compromised and move assets using the wallet provider’s recovery procedures.

Enterprises should block by default, then make exceptions​

Microsoft’s Edge enterprise documentation recommends managing extensions by permissions and the websites they may access, alongside conventional allowlists and blocklists. Its policy guidance specifically notes that extension block rules can disable an extension already installed on a user’s device, preventing the user from simply turning it back on. Google’s Chrome Enterprise documentation likewise supports blocking named extensions or blocking all extensions by default while permitting a controlled allowlist.

That is a materially better position than asking users to judge every extension listing. In a managed Windows environment, IT should inventory browser extensions across Chrome and Edge, block the 19 identifiers above, review whether any were force-installed through policy, and search endpoint telemetry for suspicious command execution associated with fake browser-update prompts.

Microsoft also gives Edge users a useful—but limited—local control: extension site access can be set to run only when clicked, on a particular site, or on all sites. Restricting an extension to a specific site reduces its reach, but it does not make an untrusted extension safe. It is a containment choice for extensions that have a legitimate, verified need; it is not a substitute for removal when a known malicious identifier is present.

The immediate action is straightforward: block the known IDs, remove them from every affected browser profile, and escalate any device where a user followed a fake update instruction into Windows. The larger lesson is less comfortable: an official extension store is a distribution channel, not a permanent security guarantee, and extensions with access to every webpage deserve the same continuous oversight as any other code running on a corporate PC.