MEXC API Automator

MEXC API Automator is a malicious Google Chrome extension targeting users of the MEXC cryptocurrency exchange. It masquerades as a tool for automating trading or simplifying MEXC API key management, but is designed to hijack victim accounts and enable theft of funds. The extension was reported by Socket’s Threat Research Team and identified as malware.

The extension is described as a Manifest V3 Chrome extension distributed through the Chrome Web Store, published on September 1, 2025, by the developer alias "jorjortan142." Its extension ID is pppdfgkfdemgfknfnhpkibbkabhghhfh. It injects a content script named script.js into MEXC API management pages matching ://.mexc.com/user/openapi* and activates when the victim is already authenticated to MEXC.

Its core behavior is to programmatically create new MEXC API keys inside the victim’s authenticated browser session, select permissions including withdrawals, and then manipulate the MEXC user interface so the withdrawal permission appears disabled even though it remains enabled server-side. Reported UI tampering includes removing the visual checked state from the withdrawal checkbox, hiding the tick mark with injected CSS, and using a MutationObserver to keep the permission visually hidden if the site restores it.

After MEXC displays the newly generated credentials, the extension extracts the Access Key and Secret Key from the page and exfiltrates them via HTTPS POST requests to the Telegram Bot API using a hardcoded bot token and chat ID controlled by the threat actor. Reported exfiltration details include the Telegram endpoint api.telegram.org, bot token 7534112291:AAF46jJWWo95XsRWkzcPevHW7XNo6cqKG9I, and chat ID 6526634583.

The attack does not require theft of the user’s password and does not bypass 2FA; instead, it abuses the victim’s existing authenticated session and waits for normal user completion of any required 2FA during API key creation. With the stolen API credentials, the threat actor can gain programmatic control of the victim’s MEXC account, execute trades, and perform automated withdrawals. The risk can persist after the extension is removed because the created API keys remain valid until revoked.

High-confidence attribution in the reporting is limited. Socket reported Russian-language inline comments in the code and assessed with moderate confidence that the operator is a Russian speaker. The activity was also linked in reporting to a broader crypto-focused threat cluster associated with the "SwapSushi" brand and the handle "jorjortan142," but country-level attribution was not established. The malware specifically targets cryptocurrency exchange users, particularly MEXC users managing API keys for bots or automated trading.