Loading story…
A Chrome extension named Crypto Copilot was discovered to be malicious, secretly injecting additional Solana (SOL) transfer instructions into Raydium swap transactions. Marketed as a tool for trading crypto directly from X (formerly Twitter), the extension covertly siphons a minimum of 0.0013 SOL or 0.05% of the trade amount to a hardcoded attacker-controlled wallet, without disclosing this behavior to users. The malicious code is heavily obfuscated and the extension remains available for download on the Chrome Web Store, with takedown requests submitted but not yet actioned.
The extension manipulates the transaction by appending a hidden SystemProgram.transfer instruction before the user signs, making the unauthorized transfer indistinguishable in the wallet confirmation screen. It also communicates with attacker-controlled backend domains to register wallets and report user activity. The extension targets users of popular Solana wallets like Phantom and Solflare, and leverages the Raydium decentralized exchange to execute the fraudulent transfers, leaving users unaware of the hidden platform fee being deducted from each swap.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
Following disclosure, researchers reported that Crypto Copilot was still available on the Chrome Web Store and that takedown requests had been submitted. Public reporting also noted the extension had limited distribution, with one source citing 12 installs.
Security researchers determined that Crypto Copilot used obfuscated code, hardcoded wallet addresses, and disposable backend infrastructure to steal funds from users. They also found the extension mimicked legitimate trading tools and reported that the attacker wallet had so far received only relatively small amounts.
After publication, the extension targeted Solana traders using Raydium by appending a concealed transfer to each swap transaction. The hidden fee sent at least 0.0013 SOL or 0.05% of the trade amount to a hardcoded attacker-controlled wallet without user disclosure.
The malicious Chrome extension Crypto Copilot was made available on the Chrome Web Store in 2024. Sources place its publication in early-to-mid 2024, with one report citing May 7, 2024, and another citing June 18, 2024.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active **Silent Swap** campaign that distributes a fake **"Google Notes"** browser extension to steal cryptocurrency by replacing copied wallet addresses with attacker-controlled ones during transactions. The operation uses unsigned **.NET** and **Golang** installers to silently sideload the malicious extension into Chromium-based browsers including **Chrome, Edge, Brave, and Opera**, where it monitors clipboard activity and browser input for wallet strings across multiple blockchains and swaps them in real time. The malware reportedly abuses Chromium trust mechanisms by altering **Secure Preferences** and related settings files, recalculating integrity values so the extension appears legitimately installed without user approval. Researchers said the campaign also uses **EtherHiding**-style blockchain-based command-and-control, querying a smart contract through public RPC infrastructure to resolve active C2 domains such as `devops-offensive[.]cc` and `Zebregts[.]com`, complicating detection and takedown. The activity has been linked to the **CountLoader** threat actor, with infections observed globally and a heavier concentration in **India**, while dynamic per-victim wallet mapping and published hashes, domains, payload URLs, and Bitcoin wallet indicators suggest a broad effort to monetize consumer cryptocurrency transactions.
Jul 2, 2026
The **Razy** malware family was found compromising **Google Chrome, Mozilla Firefox, and Yandex Browser** by disabling extension integrity checks and browser auto-updates, then installing or replacing extensions with malicious versions. In Chrome-based browsers, it could infect existing extensions including the built-in **Chrome Media Router** component; in Firefox, it deployed a fake extension called **"Firefox Protection"**; and in Yandex Browser, it replaced an extension with one masquerading as **Yandex Protect**. The malware’s primary goal was **cryptocurrency theft and fraud**. It replaced wallet addresses and QR codes, altered cryptocurrency exchange pages, injected phishing and scam content, and manipulated **Google** and **Yandex** search results. Supporting scripts including `extab.js` and `bgs.js` injected remote content and sent telemetry through **Firebase**, while remotely loaded `i.js` and `main.js` handled ad injection, page modification, and wallet substitution. The campaign also used phishing domains such as `ton-ico[.]network` and `ooo-ooo[.]info`, and wallets embedded in the analyzed scripts had reportedly received about **0.14 BTC** and **25 ETH**.
Aug 14, 2026
Researchers uncovered multiple browser-extension campaigns that abused clipboard access to steal sensitive data and cryptocurrency. Socket found that Chrome and Firefox extensions branded as **VPN Go: Free VPN** initially behaved like legitimate proxy tools before later updates added clipboard monitoring, data chunking, session tagging, and HTTP exfiltration to hardcoded attacker-controlled IP addresses. The Chrome extension turned malicious in version `1.1`, while the Firefox add-on first did so in version `1.3.3`, indicating a staged update strategy designed to retain users while covert theft ran in parallel. A separate campaign tracked as **Silent Swap** used unsigned installers to deploy a fake **Google Notes** Chromium extension that replaced copied wallet addresses with attacker-controlled ones, enabling cryptocurrency theft across multiple coins. McAfee said the malware modified Chromium preference files and recalculated integrity values to avoid detection, while using **EtherHiding** and blockchain-based dead-drop resolution to fetch command-and-control details; the activity also overlaps with **CountLoader**, suggesting a shared operator. Google and Mozilla were notified about the malicious VPN-themed extensions, and users who copied passwords, wallet addresses, or other secrets while the add-ons were installed are advised to treat that data as compromised.
Jun 30, 2026