Loading story…
Researchers identified a new CopperStealer campaign that installs a malicious Chromium-based browser extension to steal cryptocurrency from users logged into Coinbase. The extension captures or creates Coinbase API keys, prompts victims with a fake modal to collect 2FA codes, and then uses the Coinbase API to transfer 85% of available wallet balances to attacker-controlled addresses. The malware targets multiple Chromium-based browsers by altering browser preference files and registry allow lists to force extension installation.
The campaign has been distributed through fake crack and warez sites using a bundled dropper that also delivers a browser stealer and additional malware. Investigators linked the operation to earlier CopperStealer activity through shared delivery methods, DGA-style command-and-control domains, and CodeIgniter-based C2 infrastructure, indicating an evolution of the malware from credential theft into direct cryptocurrency account takeover and fund exfiltration.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that a new CopperStealer deployment distributing a malicious Chromium-based browser extension had been observed in the wild since July 2022. The malware was delivered via fake crack or warez sites in a bundled dropper and targeted cryptocurrency users, including Coinbase users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used fake cryptocurrency-themed websites to distribute **SpyAgent**, a malware loader that communicates with command-and-control servers using periodic HTTP `GET` requests containing a 9-digit victim ID and an environment hash derived from system values such as `MachineGuid`, Windows product name, username, and computer name. The malware also monitored keyboard and mouse inactivity, reporting when a victim became idle, how long the idle period lasted, and when activity resumed, giving operators visibility into when a compromised device was unattended. The campaign appeared financially motivated and was geared toward credential theft, cryptocurrency wallet theft, and clipboard hijacking to replace wallet addresses during transactions. SpyAgent was used to fetch and run additional commodity malware, including **RedLine Stealer, Ducky stealer, AZORult, Cypress Stealer, Clipper, Remcos RAT, NanoCore, njRAT, and AsyncRAT**, expanding the operators’ ability to steal data, maintain access, and monetize infected systems.
Aug 14, 2026
Researchers uncovered the **Superior** campaign, in which attackers distributed 18 malicious Chrome extensions and one Microsoft Edge extension that stole cryptocurrency-wallet secrets, credentials, browser data, and social-media sessions. The operator reportedly acquired legitimate extensions—or first published benign versions—then used automatic extension updates to install a modular malware framework after building an install base; the activity may have begun in early 2024. The extensions used encrypted persistent WebSocket connections for command-and-control, received rotatable infrastructure endpoints, removed page Content Security Policy headers, and injected malicious scripts into sites victims visited. Modules supported wallet draining, seed-phrase phishing, exchange-session theft, form and credential capture, browser-history collection, and ClickFix-style fake-update lures. Google removed the identified Chrome extensions, but an affected Edge extension remained available at reporting time; users should remove affected extensions, change passwords, revoke active sessions, and move cryptocurrency to newly created wallets.
Sep 4, 2026
Researchers uncovered multiple browser-extension campaigns that abused clipboard access to steal sensitive data and cryptocurrency. Socket found that Chrome and Firefox extensions branded as **VPN Go: Free VPN** initially behaved like legitimate proxy tools before later updates added clipboard monitoring, data chunking, session tagging, and HTTP exfiltration to hardcoded attacker-controlled IP addresses. The Chrome extension turned malicious in version `1.1`, while the Firefox add-on first did so in version `1.3.3`, indicating a staged update strategy designed to retain users while covert theft ran in parallel. A separate campaign tracked as **Silent Swap** used unsigned installers to deploy a fake **Google Notes** Chromium extension that replaced copied wallet addresses with attacker-controlled ones, enabling cryptocurrency theft across multiple coins. McAfee said the malware modified Chromium preference files and recalculated integrity values to avoid detection, while using **EtherHiding** and blockchain-based dead-drop resolution to fetch command-and-control details; the activity also overlaps with **CountLoader**, suggesting a shared operator. Google and Mozilla were notified about the malicious VPN-themed extensions, and users who copied passwords, wallet addresses, or other secrets while the add-ons were installed are advised to treat that data as compromised.
Jun 30, 2026