when

Read

Two malicious Google Chrome browser extensions allegedly drained $800,000 from a cryptocurrency investor going by the moniker “Sell When Over” on X. 
In a series of <a href="https://x.com/sell9000/status/1777158691214569636" target="_blank" rel="">posts</a> on X, the user speculated that the malicious extensions dubbed “Sync test BETA (colorful)” and “Simple Game” possibly contained Keyloggers that target specific wallet extension apps. Keyloggers are malicious applications used by cyber criminals to record every keystroke of a target’s computer. This allows the attackers to <a href="https://crypto.news/nft-blogger-hacked-losses-assets-after-clicking-a-phishing-advertisement-link-on-google/" rel="">access confidential information</a> from a victim’s computer. 
According to the user, the issue initially surfaced after Google Chrome released an update last month. The user, who had been delaying the Chrome update, was forced to restart their computer after Windows released a PC update. 
Interestingly, following the restart, which is a common step when installing operating system updates, all of the user’s extensions on Chrome were logged out, and all their tabs were gone. This forced the user to re-enter all their credentials on Chrome, along with their seed phrases for their cryptocurrency wallets. 
The user speculates that this is when their confidential information was compromised via the keylogger. The funds were reportedly drained three weeks after this event. Further, the user did not notice any unusual activity in their browser following the restart. 
“I checked my virus scanner and there were no issues. No additional weird extensions appeared. I proceeded to re-import my seed phrases,” the user wrote. 
It was only during a later investigation that the user discovered the two malicious extensions on their system. Further, their browser also had Google Translate set up to auto-translate to Korean. 
 You might also like: <a href="https://crypto.news/trader-loses-over-674k-to-phishing-scam/" rel=""> Trader loses over $674K to phishing scam </a> 
As of the latest update, the attackers reportedly sent the funds to two exchanges, the Singapore-based <a href="https://crypto.news/airdao-suffers-exploit-hackers-transfer-stolen-funds-to-mexc-kucoin-changenow/" rel="">MEXC</a> exchange and the Cayman Islands-headquartered <a href="http://gate.io" target="_blank" rel="">Gate.io</a>.&nbsp; 
While the user remained unsure how exactly their Chrome browser was compromised, their analysis confirmed that the Sync test BETA (colorful) extension was a keylogger. The extension was reportedly sending data to an external website’s PHP script. The attacker’s website, when opened manually, shows a blank page with only “Hi” written on it. Meanwhile, the “Simple game” extension was “checking if tabs are updated/open/closed/refreshed,” the user added.&nbsp;&nbsp; 
“This is a $800k costly mistake — lesson is if anything seems off such that it prompts you to input a seed, then wipe the whole PC first,” Sell When Over wrote. 
At the time of publication, neither of the extensions showed up on the <a href="https://chromewebstore.google.com/" target="_blank" rel="">Chrome Web store</a>. 
Malicious extensions on Google Chrome have been plaguing the cryptocurrency sector for years. In a 2023 <a href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/new-rilide-stealer-version-targets-banking-data-and-works-around-google-chrome-manifest-v3/" target="_blank" rel="">report</a>, cybersecurity researchers revealed that hackers were employing a chrome malware dubbed Rilide to steal sensitive data and cryptocurrency from unsuspecting victims. The malware was used to deploy rouge browser extensions capable of draining crypto funds. 
As previously <a href="https://crypto.news/avast-uncovers-chrome-extension-used-to-steal-passwords-and-crypto/" rel="">reported</a> by Crypto.news, another piece of Windows malware was discovered in late 2022. It used Google Chrome extensions to steal cryptocurrencies and clipboard data. The extensions could edit HTML on websites to display the actual user funds in a wallet while draining the wallet in the background.&nbsp; 
 Read more: <a href="https://crypto.news/binance-user-loses-70k-in-hack-support-says-email-provider-to-blame/" rel=""> Binance user loses $70k in hack, support says email provider to blame </a>

Trader loses $800k in crypto to malicious Google Chrome extension

crypto.news

Other articles published on Apr 8, 2024

Pepe Coin price analysis: Can PEPE hit $0.000010 in April?

Morgan Creek-Backed Metaplanet Taps Bitcoin (BTC) As Treasury Asset

SEC Secures Ruling Against Do Kwon and Terraform Labs

Robinhood’s Bitcoin holdings surpass $9.5b, third only to Bitfinex and Binance

AI Chip Stocks Surge as Demand Skyrockets

Cardano Founder Focused On Upgrades While Defending ‘BitBoy’

Join our free newsletter for daily crypto updates!