Malicious Browser Extensions Hijack Clipboards to Steal Cryptocurrency and Secrets

Researchers uncovered multiple browser-extension campaigns that abused clipboard access to steal sensitive data and cryptocurrency. Socket found that Chrome and Firefox extensions branded as VPN Go: Free VPN initially behaved like legitimate proxy tools before later updates added clipboard monitoring, data chunking, session tagging, and HTTP exfiltration to hardcoded attacker-controlled IP addresses. The Chrome extension turned malicious in version 1.1, while the Firefox add-on first did so in version 1.3.3, indicating a staged update strategy designed to retain users while covert theft ran in parallel.

A separate campaign tracked as Silent Swap used unsigned installers to deploy a fake Google Notes Chromium extension that replaced copied wallet addresses with attacker-controlled ones, enabling cryptocurrency theft across multiple coins. McAfee said the malware modified Chromium preference files and recalculated integrity values to avoid detection, while using EtherHiding and blockchain-based dead-drop resolution to fetch command-and-control details; the activity also overlaps with CountLoader, suggesting a shared operator. Google and Mozilla were notified about the malicious VPN-themed extensions, and users who copied passwords, wallet addresses, or other secrets while the add-ons were installed are advised to treat that data as compromised.