Loading story…
The Razy malware family was found compromising Google Chrome, Mozilla Firefox, and Yandex Browser by disabling extension integrity checks and browser auto-updates, then installing or replacing extensions with malicious versions. In Chrome-based browsers, it could infect existing extensions including the built-in Chrome Media Router component; in Firefox, it deployed a fake extension called "Firefox Protection"; and in Yandex Browser, it replaced an extension with one masquerading as Yandex Protect.
The malware’s primary goal was cryptocurrency theft and fraud. It replaced wallet addresses and QR codes, altered cryptocurrency exchange pages, injected phishing and scam content, and manipulated Google and Yandex search results. Supporting scripts including extab.js and bgs.js injected remote content and sent telemetry through Firebase, while remotely loaded i.js and main.js handled ad injection, page modification, and wallet substitution. The campaign also used phishing domains such as ton-ico[.]network and ooo-ooo[.]info, and wallets embedded in the analyzed scripts had reportedly received about 0.14 BTC and 25 ETH.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered multiple browser-extension campaigns that abused clipboard access to steal sensitive data and cryptocurrency. Socket found that Chrome and Firefox extensions branded as **VPN Go: Free VPN** initially behaved like legitimate proxy tools before later updates added clipboard monitoring, data chunking, session tagging, and HTTP exfiltration to hardcoded attacker-controlled IP addresses. The Chrome extension turned malicious in version `1.1`, while the Firefox add-on first did so in version `1.3.3`, indicating a staged update strategy designed to retain users while covert theft ran in parallel. A separate campaign tracked as **Silent Swap** used unsigned installers to deploy a fake **Google Notes** Chromium extension that replaced copied wallet addresses with attacker-controlled ones, enabling cryptocurrency theft across multiple coins. McAfee said the malware modified Chromium preference files and recalculated integrity values to avoid detection, while using **EtherHiding** and blockchain-based dead-drop resolution to fetch command-and-control details; the activity also overlaps with **CountLoader**, suggesting a shared operator. Google and Mozilla were notified about the malicious VPN-themed extensions, and users who copied passwords, wallet addresses, or other secrets while the add-ons were installed are advised to treat that data as compromised.
Jun 30, 2026
Researchers reported an active **Silent Swap** campaign that distributes a fake **"Google Notes"** browser extension to steal cryptocurrency by replacing copied wallet addresses with attacker-controlled ones during transactions. The operation uses unsigned **.NET** and **Golang** installers to silently sideload the malicious extension into Chromium-based browsers including **Chrome, Edge, Brave, and Opera**, where it monitors clipboard activity and browser input for wallet strings across multiple blockchains and swaps them in real time. The malware reportedly abuses Chromium trust mechanisms by altering **Secure Preferences** and related settings files, recalculating integrity values so the extension appears legitimately installed without user approval. Researchers said the campaign also uses **EtherHiding**-style blockchain-based command-and-control, querying a smart contract through public RPC infrastructure to resolve active C2 domains such as `devops-offensive[.]cc` and `Zebregts[.]com`, complicating detection and takedown. The activity has been linked to the **CountLoader** threat actor, with infections observed globally and a heavier concentration in **India**, while dynamic per-victim wallet mapping and published hashes, domains, payload URLs, and Bitcoin wallet indicators suggest a broad effort to monetize consumer cryptocurrency transactions.
Jul 2, 2026
Researchers uncovered a campaign dubbed **Offside Wallet Theft Factory** that used at least **40 malicious Firefox extensions** impersonating Web3 products including **OKX**, **Rabby Wallet**, and **TronLink** to steal cryptocurrency wallet data. The operation is tied to a broader cluster of **77 browser add-ons** sharing source code and infrastructure, and is believed to have been active since **March 2026**. Investigators said some of the add-ons were initially published on the official Firefox marketplace as benign sports-score or utility extensions before being repurposed under the same Firefox IDs into wallet-stealing malware. The extensions used several theft methods, including fake wallet pages and phishing redirects, embedded logic to capture **seed phrases**, serialized keyrings, credentials, and clipboard contents, and exfiltration through **Cloudflare Workers** and attacker-controlled **Supabase** projects that also acted as remote switches. Reporting also identified recurring code markers and infrastructure overlap across the packages, including shared request tokens, hard-coded command-and-control elements, custom hook endpoints, a dedicated IP address, and a phishing page on `pages.dev` delivered by a fake **0KX WEB3** extension. The activity has not been attributed to a known threat actor.
Aug 20, 2026