Cybersecurity firm Socket uncovered a malicious Google Chrome extension named 'Crypto Copilot' that discreetly steals Solana (SOL) from users during swap transactions. The extension, which has been available since June 18, 2024, markets itself as a tool for executing trades directly from X (formerly Twitter) feeds, routing swaps through the Raydium decentralized exchange.
Socket's report, released on Tuesday, detailed that the extension injects an extra transfer instruction into every Solana swap, siphoning a minimum of 0.0013 SOL or 0.05% of the trade value to the attacker's wallet. This occurs without user awareness, as wallet interfaces like Phantom summarize transactions without displaying individual instructions. Users sign what appears to be a single swap, but both the legitimate swap and the hidden transfer execute atomically on-chain, Socket explained.
The malicious code is heavily obfuscated in JavaScript, making detection difficult, and the extension connects to a backend domain with typos to track activity. Despite its longevity, the Chrome Web Store reports only 15 active users, and Socket has submitted a takedown request. This incident highlights ongoing security risks in browser extensions, following similar warnings about crypto-draining malware in popular Chrome add-ons earlier this year.
CRO
DOT
ZEC
FIL
LIVE
TAP
USDT
MNT
NEX
USDC
BTC
ETH