<h2 id="header-0">Background</h2>On March 1, 2024, Twitter user &#64;doomxbt reported an unusual activity on their Binance account, suspecting that their funds were stolen.<img src="https://miro.medium.com/v2/resize:fit:700/1*UVGlU5d2mn5AhflqxZ2_JQ.png" /><a href="https://x.com/doomxbt/status/1763237654965920175" rel="noopener noreferrer nofollow">https://x.com/doomxbt/status/1763237654965920175</a>Initially, this incident did not attract much attention. However, on May 28, 2024, Twitter user &#64;Tree_of_Alpha analyzed the situation and discovered that the victim, &#64;doomxbt, had likely installed a malicious Aggr extension from the Chrome Store, which had many positive reviews (we have not directly verified this with the victim). This extension was capable of stealing all cookies from websites visited by the user, and it was promoted by influencers who were paid to endorse it two months ago.<img src="https://miro.medium.com/v2/resize:fit:700/1*-I4FTJqtCmyDoiPP8umP6Q.png" /><a href="https://x.com/Tree_of_Alpha/status/1795403185349099740" rel="noopener noreferrer nofollow">https://x.com/Tree_of_Alpha/status/1795403185349099740</a>In recent days, this incident has garnered increased attention. Some victims had their login credentials stolen, and subsequently, hackers used double-spending attacks to steal their cryptocurrency assets. Many users have reached out to the SlowMist Security Team for assistance regarding this issue. We will now provide a detailed analysis of this attack to raise awareness within the crypto community.<h2 id="header-1">Analysis</h2>First, we needed to locate this malicious extension. Although Google has already removed it, we can still view some historical data through snapshots.<img src="https://miro.medium.com/v2/resize:fit:700/0*xYDj2yzH0vwXQbW2" />After downloading and analyzing the extension, we found that the main JavaScript files were background.js, content.js, jquery-3.6.0.min.js, and jquery-3.5.1.min.js.During our analysis, we discovered that background.js and content.js contained no complex or suspicious code. However, we found a link to a site in background.js, which sent data collected by the extension to https[:]//aggrtrade-extension[.]com/statistics_collection/index[.]php.<img src="https://miro.medium.com/v2/resize:fit:700/0*annd6VXbvTHwk0Jx" />By examining the manifest.json file, we noted that background used /jquery/jquery-3.6.0.min.js and content used /jquery/jquery-3.5.1.min.js. We focused our analysis on these two jQuery files.&#xff1a;<img src="https://miro.medium.com/v2/resize:fit:700/0*40v87kaGdX8VY66K" />In jquery/jquery-3.6.0.min.js, we discovered malicious code that processed browser cookies into JSON and sent them to https[:]//aggrtrade-extension[.]com/statistics_collection/index[.]php.<img src="https://miro.medium.com/v2/resize:fit:700/0*yaLH9GGFidivr1GG" />After our analysis, we proceeded to install and debug the extension in a clean testing environment (without logging into any accounts) and redirected the malicious site to a controlled one to avoid sending sensitive data to the attackers’ server.Once the malicious extension was installed, we visited a site like google.com and observed the network requests in the extension’s background. We found that Google’s cookies were being sent to an external server.<img src="https://miro.medium.com/v2/resize:fit:700/0*_DA_RvyI4SJQBEgi" />We also saw the cookies data being transmitted on our Weblog service.<img src="https://miro.medium.com/v2/resize:fit:700/0*gdO2z4O7sfVEln7X" />If attackers obtained users’ authentication credentials and information, they could hijack cookies via the browser extension and perform double-spending attacks on trading websites, stealing users’ crypto assets.Next, we analyzed the malicious link https[:]//aggrtrade-extension[.]com/statistics_collection/index[.]php.Domain involved: aggrtrade-extension[.]com<img src="https://miro.medium.com/v2/resize:fit:700/0*4EKIZHxaHQzbhNNN" />Parsing the domain information:<img src="https://miro.medium.com/v2/resize:fit:700/0*qGyOUhiV39x5WmhR" />The .ru domain suggests the attackers are likely Russian or Eastern European hacker groups.<h3 id="strong-attack-timeline-strong">Attack Timeline</h3>Analyzing the fake AGGR (aggr.trade) site aggrtrade-extension[.]com, we found that hackers had been planning this attack for three years:<img src="https://miro.medium.com/v2/resize:fit:700/0*mrOPKG1iw4yLchOi" /><img src="https://miro.medium.com/v2/resize:fit:700/0*b58-9_1XmN3iRlQm" />Four months ago, the hackers began deploying the attack:<img src="https://miro.medium.com/v2/resize:fit:700/0*QxBv_R5ovbqo-Bwb" /><img src="https://miro.medium.com/v2/resize:fit:700/0*DZFi_yqr7uBO4xp2" /><img src="https://miro.medium.com/v2/resize:fit:700/0*oDUEG81CZs3VdHVB" />According to InMist Threat Intelligence Network, we discovered that the hackers’ IP was located in Moscow, using VPS services from srvape.com, with the email aggrdev&#64;gmail.com.<img src="https://miro.medium.com/v2/resize:fit:700/0*wdYv91mqs8iMcCh-" />Once the deployment was successful, hackers started promoting the extension on Twitter, waiting for victims to take the bait. The rest is history; some users installed the malicious extension and were subsequently robbed.Below is the official warning from AggrTrade:<img src="https://miro.medium.com/v2/resize:fit:700/1*a5FWB6UoURTp9YP8a4ELXw.png" /><a href="https://x.com/AggrTradeApp/status/1795896255249265042" rel="noopener noreferrer nofollow">https://x.com/AggrTradeApp/status/1795896255249265042</a><h2 id="header-2">Conclusion</h2>The SlowMist Security Team reminds users that browser extensions pose risks nearly as significant as running executable files. Always thoroughly review extensions before installation. Be cautious of unsolicited messages, as hackers and scammers often impersonate legitimate projects, targeting content creators under the guise of sponsorship or promotion. In the dark forest of blockchain, maintain a skeptical mindset and ensure everything you install is secure to prevent hackers from exploiting vulnerabilities.<h3 id="about-slowmist">About SlowMist</h3>At SlowMist, we pride ourselves on being a frontrunner in blockchain security, dedicating years to mastering threat intelligence. Our expertise is grounded in providing comprehensive security audits and advanced anti-money laundering tracking to a diverse clientele. We’ve established a robust network for threat intelligence collaboration, positioning ourselves as a key player in the global blockchain security landscape. We offer tailor-made security solutions that span from identifying threats to implementing effective defense mechanisms. This holistic approach has garnered the trust of numerous leading and recognized projects worldwide, including names like Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, and Cheers UP. Our mission is to ensure the blockchain ecosystem is not only innovative but also secure and reliable.We offers a variety of services that include but are not limited to security audits, threat intelligence, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) solutions, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we wish to help spread awareness and raise the security standards in the blockchain ecosystem.&#x1f4ac;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">Website</a> &#x1f426;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">Twitter </a>⌨️<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">GitHub</a>

Wolf in Sheep’s Clothing | Fake Chrome Extension Theft Analysis

Table of Contents

SlowMist

Other articles published on Jun 5, 2024

Shiba Inu (SHIB) in Trouble, Again, Will XRP Finally Break $0.52 Resistance? Cardano (ADA) Isn't ...

Crypto Expert Reveals Top 3 Trades To Take Now

3 Altcoins Below $1 That You Can Buy Now For 100x Returns In The Bull Run

MoonBag Arise as a Leader in Top Crypto Presale Space, Leaving DOGEVERSE and BOME Trailing Behind

Investors Turn to Altcoins as Bitcoin Rises

Vitalik Buterin slams celebrity memecoins

Join our free newsletter for daily crypto updates!