Google's store lists 50,000 users for a Bitcoin price extension advertised at $55,650, with the offer including the published product, its source code, and help handing it over, giving a buyer an established crypto-facing audience rather than a ticker built from scratch.
Related Asset Bitcoin #1 BTC · $67,188.80 24-hour change: down 2.96% Loading price history… 24H Down 2.96% 7D Down 11.46% 30D Down 17.01%
The Bitcoin Price Tracker listing, listed on Sept. 29, puts a price on a product people have already chosen to install. Acquiring the product can also put a new owner in charge of future updates, extending the sale's consequences to people who already installed it.
The sale advertisement does not document a completed transaction or connect the product or its seller to malware.
Related Company Google An American multinational technology company
In a separate investigation published in August, security firm Socket documented attackers acquiring five functional extensions from their authors and introducing malicious updates. Socket's Superior campaign tracker still labels that operation ongoing, with its latest recorded activity dated Nov. 6.
What the Bitcoin price tracker buyer gets
Bitcoin Price Tracker's Chrome Web Store page displays 50,000 users and identifies Extpose as its provider. It displays BTC/USD pricing from Binance in the browser toolbar.
Related Company Binance Global crypto exchange
The seller separately reports 37,100 installs from Sept. 14, 2025, through Sept. 13, 2026.
The advertisement describes the product as pre-revenue and offers a buyer opportunities to develop financial-information services or relevant partner offers. The $55,650 is an asking price for the extension, code, and 14 days of handover assistance.
Two other advertisements show how the same proposition extends beyond crypto tools:
| Advertised product | Asking price | Included assets | Audience evidence |
|---|---|---|---|
| Bitcoin Price Tracker | $55,650 | Published Chrome product, code and handover assistance | Google store displays 50,000 users; seller separately reports 37,100 installs over Sept. 14, 2025–Sept. 13, 2026 |
| Page Auto Refresh | $24,999 | Chrome and Edge products, both source codes, website and domain | Seller reports 61,363 Chrome Weekly users on Sept. 2, 2026, and 49,299 Edge Weekly users on Aug. 30, 2026 |
| Translate | $9,999 | Chrome and Edge products and source code | Seller reports 17,153 Chrome Weekly users on Sept. 8, 2026, and 26,084 Edge Weekly users on Sept. 6, 2026 |
The Page Auto Refresh and Translate figures come from dated publisher analytics described by the seller. The offers also include different assets, so their asking prices don't establish a standard price per audience member.
Control can change before the public listing does
Microsoft's documentation describes a current-owner support request followed by review and explicit confirmation from both publishers, and the process typically takes approximately three weeks, depending on responses.
Related Company Microsoft American multinational technology company
After an Edge transfer, the new owner gains full control over the extension's listing and updates. But the public presentation does not necessarily change at the same moment.
Microsoft says changes to the description, screenshots, privacy-policy URL, owner name, and website link do not automatically appear when ownership transfers. The previous information remains visible until the new owner publishes an extension update.
On Edge, that creates a distinction between what they see and who controls the product. A familiar name on a listing may describe the previous owner, even though the transfer has already given someone else update rights. Microsoft describes this display lag as part of the Edge transfer process.
Buying an extension can transfer control of its next update
The audience already exists. A new owner can direct future versions, while Microsoft's Edge process can leave previous-owner details visible until an update.
THE OWNERSHIP HANDOVEROriginal developerA functional published tool
acquisitionNew ownerControls future development
updates
The extensionIts next version
reaches
Existing installationsAudience already in placeCurrent sale offers are separate from the documented malicious acquisitions.
HISTORICAL EXAMPLE · QUICKLENS · FEBRUARY 2026
16 daysFeb. 1New owner recordFeb. 17Malicious version 5.8
THE OWNERSHIP HANDOVEROriginaldeveloperWorking toolNew ownerUpdate control
Acquisition
The extensionIts next version
reaches
Existing installationsAudience already in placeCurrent offers are separate fromthe documented malicious cases.
QUICKLENS · FEBRUARY 2026
16 daysFeb. 1New owner recordFeb. 17Malicious v5.8
What appears publicly in Microsoft Edge？What appears publicly in Microsoft Edge？After ownership transferAfter an extension update
The new owner controls listing and updates, while previous-owner details can remain visible until the extension is updated.
New ownerListing + update control
controlsPUBLIC EDGE LISTINGPrevious owner namePrevious policy / websiteOld details can remain visible
New ownerListing + update control
controlsPUBLIC EDGE LISTINGPrevious owner namePrevious policy / websiteOld details can remain visible
Publishing an extension update makes changed owner, policy and website fields visible. Control remains with the new owner.
New ownerListing + update control
controlsPUBLIC EDGE LISTINGUpdated owner nameUpdated policy / websiteField changes become visible
New ownerListing + update control
controlsPUBLIC EDGE LISTINGUpdated owner nameUpdated policy / websiteField changes become visible
An installed tool's familiar identity and the party deciding its next update can diverge.
Edge listing behavior is not asserted for Chrome. The cited evidence does not link the current sale offers or seller to the documented malicious cases. Arrows show control and distribution, not guaranteed infection, bypass of permission prompts or victim counts.
Sources and evidence
Sources
- www.sideprojectors.com
- www.sideprojectors.com
- www.sideprojectors.com
- socket.dev
- annex.security
- learn.microsoft.com
- According to Socket, initially functional, clean extensions later received malicious versions; acquisition of established products gave attackers an existing distribution base. [4]
- Microsoft states that the new owner gains full control over the extension's listing and updates, while owner name, description, screenshots, privacy-policy URL and website link do not automatically change publicly until the new owner publishes an update. [6]
- Microsoft's transfer procedure calls for a current-owner support request, review and explicit confirmation with both publishers, with processing typically taking approximately three weeks. [6]
- Annex's February 23 report records a new QuickLens owner on February 1, 2026 and release of malicious version 5.8 on February 17, 16 calendar days later. [5]
- Annex reports QuickLens was listed for sale on October 11, 2025, and that the malicious update added permissions that would trigger a user permission prompt; the original image-search function remained operational. [5]
- The three current sale advertisements do not document completed sales or a connection between their advertised products or seller and the Superior malware campaign. [1] [2] [3] [4]
Supporting facts
Method
Qualitative ownership and distribution diagram; geometry is schematic, not audience size. Edge states follow Microsoft's transfer document. QuickLens dates are Annex's recorded owner and release milestones, not the contract closing date.
Scope
Edge listing behavior is not asserted for Chrome. The cited evidence does not link the current sale offers or seller to the documented malicious cases. Arrows show control and distribution, not guaranteed infection, bypass of permission prompts or victim counts.
Infographic by CryptoSlate
Google's enterprise publishing guidance directs developers seeking to transfer an extension to the organization they publish to toward Chrome Web Store support.
Google's program policies prohibit malware and phishing and restrict the use of collected information to the extension's disclosed purpose. An exception for transferring that information as part of a merger, acquisition, or asset sale requires explicit prior consent.
What a malicious buyer can change
In its Aug. 27 investigation, Socket identified 19 malicious extensions: 18 for Chrome and one for Edge. It classified 14 as created by the attacker and five as bought from legitimate authors.
According to Socket, the acquired products initially performed their advertised functions without malware, but later versions introduced malicious behavior, giving the attacker an existing distribution base.
In its analysis of the acquired right-click extension, Socket described wallet-connection and swap hijacking, fake Ledger and Trezor recovery interfaces designed to collect seed phrases, and account or session harvesting. It also described a framework that downloaded changeable JavaScript, removed Content Security Policy protections, and injected code into visited pages.
Related Company Ledger Crypto hardware wallets
Socket estimated approximately 70,000 Chrome users and 10,000 Edge users for the largest acquired right-click utility, describing a potential exposure surface of 80,000.
Related Company Trezor Hardware wallet manufacturer
In its February report, Annex recorded a new owner for the image-search extension QuickLens appearing on Feb. 1, followed by a malicious version 5.8 just 16 days later.
Annex said the update added permissions that would trigger an acceptance prompt, while the original image-search functionality continued to work.
The case shows why continued usefulness is a weak assurance about the rest of an extension's behavior, and also why an ownership change should not be described as automatically bypassing every permission safeguard.
As viewed on Nov. 13, Socket's Superior tracker labels the campaign “Ongoing,” gives Nov. 6 as its last-activity date, and records 33 affected package artifacts representing 24 unique packages.
The current sale offers remain separate from those confirmed malicious acquisitions, and their significance is that an established extension's reach and future development can be acquired, while the decision to install and trust it may have been made under another owner.
The practical question for crypto investors is whether a familiar tool's ownership, permissions, and behavior still justify keeping it installed. Socket recommends regularly reviewing extensions and removing unnecessary or suspicious ones.