DYOR

2024

Read

<p class="is-style-lead">Crypto users discovered a harmful Google Chrome extension designed to steal funds by manipulating website cookie data.</p>
<p>Binance trader “doomxbt” first spotted the issue in February after noticing $70,000 in losses linked to suspicious activity. The attacker initially deposited the stolen funds on the AI-powered crypto exchange SideShift.&nbsp;</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">i have been compromised in some strange way and my <a href="https://twitter.com/binance?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@binance</a> account was drained out, out of nowhere i heard sound notifications about orders getting filled while i never placed any – suddenly my 70k amount was suddenly 0 on screen <a href="https://t.co/NEkSQVbBQc" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/NEkSQVbBQc</a></p>— 𝔡𝔬𝔬𝔪 (@doomxbt) <a href="https://twitter.com/doomxbt/status/1763237654965920175?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">February 29, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>On Tuesday, the culprit was <a href="https://x.com/Tree_of_Alpha/status/1795403185349099740" target="_blank" rel="noopener noreferrer nofollow">reportedly</a> linked to a fake Aggr app extension on Google’s Chrome store. Unlike the legitimate Aggr app which provides professional trading tools like on-chain liquidation trackers, the malicious version included code to collect all website cookies from users, allowing hackers to reconstruct passwords and user keys, especially for Binance accounts.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">⚠️DO NOT DOWNLOAD THE AGGR CHROME EXTENSION⚠️<br><br>We finally found how <a href="https://twitter.com/doomxbt?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@doomxbt</a> lost his funds on Binance. <br>There is a malicious Aggr app on the Chrome store with good reviews that steals all cookies on all websites you visit, and 2 months ago someone paid a handful of influencers… <a href="https://t.co/XEPbwKX0XW" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/XEPbwKX0XW</a></p>— Tree (🌲,🌲) (@Tree_of_Alpha) <a href="https://twitter.com/Tree_of_Alpha/status/1795403185349099740?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">May 28, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>You might also like: <a href="https://crypto.news/binance-user-shares-update-on-70k-loss-incident-highlighting-security-gaps-and-response-concerns/" rel="noopener noreferrer nofollow"> Binance user shares update on $70k loss incident highlighting security gaps and response concerns </a></p>
<h2 class="wp-block-heading" id="inept-due-diligence-from-crypto-influencers-or-an-elaborate-scam">Inept due diligence from crypto influencers or an elaborate scam?</h2>
<p>Once the fake Aggr app was available on the <a href="https://crypto.news/?s=Chrome" target="_blank" rel="noopener noreferrer nofollow">Chrome</a> Store, hackers launched a social media campaign to encourage downloads.</p>
<p>The developers hired a network of influencers to promote the malicious software in a process known as “shilling”. Social media accounts populated timelines with trading buzzwords to convince users the tool was needed.</p>
<p>In this case, these influencers either forgot the popular crypto chant “do your own research” AKA “DYOR”, or ignored it. It’s unknown if promoters knew the fake Aggr left users vulnerable or if social media accounts profited from the attack.&nbsp;</p>
<p>Following the incident, crypto.news reached out to some promoters for comment, but at least one blocked the request.</p>
<p>This incident is part of a larger trend, as similar attacks using Chrome extensions have occured recently. Last month, a trader lost over $800,000 in digital assets after <a href="https://crypto.news/trader-loses-800k-in-crypto-to-malicious-google-chrome-extension/" rel="noopener noreferrer nofollow">interacting</a> with two malicious Chrome browser extensions.&nbsp;Users are advised to DYOR and double-check any application before downloading to devices.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">At first glance the extension is mostly harmless, importing a small "background.js" file and the popular javascript extension "jquery". <a href="https://t.co/lxFcSvxP4V" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/lxFcSvxP4V</a></p>— Tree (🌲,🌲) (@Tree_of_Alpha) <a href="https://twitter.com/Tree_of_Alpha/status/1795405089731129748?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">May 28, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>Read more: <a href="https://crypto.news/multisig-in-defi-a-marketing-gimmick-or-a-real-security-solution-opinion/" rel="noopener noreferrer nofollow"> Multisig in defi: a marketing gimmick or a real security solution? | Opinion </a></p>

Crypto users left vulnerable via sham Google Chrome extension

Table of Contents

crypto.news

Other articles published on May 28, 2024

K9 Finance Secures LBank Listing, Boosts KNNE

Sorotan Kripto: Volatilitas Bitcoin, Asa di ETF Ethereum Spot, dan Presale Furrever Token Tembus ...

From YouTube To Crypto: Steve Chen Backs Solana-based Memecoin, Here’s What To Know

Bitcoin dips 2% as Mt. Gox wallets move over $7B to unknown wallet

Healthcare Tech Stocks Skyrocket Following Announcement of Bitcoin Investment Plans

Analysts Predict Bitcoin Price Movements

Join our free newsletter for daily crypto updates!