Superior is a malicious Chrome extension cluster that installs a malware delivery framework. Malicious JavaScript payloads are extensible and modified as the malware evolves, but the main targets are cryptocurrency wallets and seed phrases. The campaign has been active since February 2024. The malicious extensions create a covert communication channel from the background service worker through which they receive malware updates and can dynamically change the C2 endpoint. Execution is achieved by stripping the Content Security Policy (CSP) protections from all web locations and performing XSS injection of downloaded JavaScript malware modules as inline JavaScript code. The campaign's footprint extends to the Edge ecosystem, where a malicious extension has also been identified. This indicates the threat actors are leveraging the same framework across multiple browser environments.