Solana

Jupiter

Meow

Decentralized exchange aggregator Jupiter says it has identified a new malicious browser extension. The extension has already drained the wallets of several Solana users and can even sneak past detectors. 
In an Aug. 20 research <a data-ct-non-breakable="null" href="https://www.jupresear.ch/t/identification-of-malicious-extension/21584" rel="null" target="null" text="null">post</a>, pseudonymous Jupiter founder Meow said “Bull Checker” — a nefarious Google Chrome browser extension — had been targeting Solana users on Reddit, advertising itself as an extension to view all the holders of specific memecoins.&nbsp;
<figure>
 <img alt="Malicious ‘bull checker’ Chrome extension found targeting Solana users" name="" src="https://s3.cointelegraph.com/uploads/2024-08/Screenshot%202024-08-20%20at%201.23.39%E2%80%AFPM">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/jupiterexchange/status/1825600323320434830?s=46&amp;t=MuRujqZUAz3TQE1vmr3c6A" rel="null" target="null" text="null">Jupiter</a>
 </figcaption>
</figure>
“If you have this extension (or similar extensions with extensive permissions you cannot trust), please remove it immediately,” wrote Jupiter in an Aug. 19 X post.
Meow said the extension was able to pass Solana simulation checks and “appear normal” but was actually a drainer designed to steal funds from users’ wallets.
“After installing Bull Checker, it will wait till a user interacts with a regular DApp [decentralized application] on the official domain, before modifying the transaction sent to the wallet to sign. After modification, the simulation result will still be ‘normal’ and not appear to be a drainer,” explained Meow. Meow said the Bull Checker extension asked users to accept permissions to “read and write” data, adding that any legitimate wallet-checking extension should only ever ask for ‘read-only’” permissions.&nbsp;
“This should have been a major red flag for users, but apparently, several users continued to install and use the extension,” he said.&nbsp;
<figure>
 <img alt="Malicious ‘bull checker’ Chrome extension found targeting Solana users" name="" src="https://s3.cointelegraph.com/uploads/2024-08/8eb1144b69509fff96685690ac0fae24cadb3fcf">
 <figcaption style="text-align: center;">
 The “Bull Checker” extension asked for permission to read and write data. Source: Jupiter
 </figcaption>
</figure>
“Users with this extension would interact with the DApps as per normal, have the simulation show up as normal, but have the possibility of their tokens being maliciously transferred to another wallet upon transaction completion,” he added.&nbsp;
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/solana-etf-still-play-despite-cboe-filing-removal-vaneck-exec" rel="null" target="null" text="null">Solana ETF ‘still in play’ despite Cboe filing removal — VanEck exec</a>
One of the users advertising the malicious extension on Reddit said they had used it to make $3,000 in the last week without providing any further specifics.&nbsp;
Jupiter reassured users that no vulnerabilities were discovered in any of the major decentralized applications or wallets on the Solana network during its investigation.&nbsp;
The discovery of the “Bull Checker” extension comes less than two weeks after Solana-based decentralized futures exchange Cypher Protocol <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/cypher-protocol-solana-hack-exploited-smart-contract" rel="null" target="null" text="null">halted its smart contract system</a> in the wake of an estimated $1 million exploit.
Meanwhile, on July 8, Matthias Mende, co-founder of the Dubai Blockchain Center, told Cointelegraph he had <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/investor-hacked-crypto-assets-100k" rel="null" target="null" text="null">fallen victim to an exploit</a> where a hacker managed to steal over $100,000 in Solana (<a data-ct-non-breakable="null" href="https://cointelegraph.com/solana-price-index" rel="null" target="null" text="null">SOL</a>) from his Phantom Wallet following his participation in a memecoin presale event.&nbsp;
Mende said he still doesn’t know how the hack occurred.&nbsp;
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/5-risks-apeing-new-solana-memecoins/" rel="null" target="null" text="null">5 dangers to beware when apeing into Solana memecoins</a>

Malicious ‘bull checker’ Chrome extension found targeting Solana users

Cointelegraph

Other articles published on Aug 20, 2024

Ethereum L2 Base Launches ENS Basenames Via Dutch Auction

Just-In: Donald Trump Regains Lead Against Kamala Harris On Polymarket

Ripple Developers Launch Batch Devnet Servers On XRP Ledger (XRPL)

Solana Price Prediction: VanEck Says SOL ETF “Still In Play” Despite Cboe Filing Removal, And Thi...

Gary Gensler Likely To Lead Treasury Department Under Kamala Harris: Report

Tron (TRX) Jump into Top 10 Cryptos: Justin Sun Reveals Millions of New Users Coming Soon”

Join our free newsletter for daily crypto updates!