The threat research team at security research organization Socket recently disclosed a serious malicious Chrome extension incident. A malicious extension called "MEXC API Automator" has been available on the Chrome Web Store since September 1, 2025, secretly generating API keys with withdrawal permissions for user accounts. Even more dangerous, this extension deliberately hides permission prompts, making users completely unaware of what is happening. The generated API keys are then transmitted back to the attacker's controlled Telegram channel, putting user accounts at serious financial risk.

This serves as a reminder to all trading users: it is crucial to download trading tools from official sources, be cautious when granting browser extension permissions, and regularly check your account API key settings. If any anomalies are detected, all suspicious API key permissions should be revoked immediately.