SlowMist exposes a fake TronLink Chrome extension phishing campaign that can steal wallet credentials such as seed phrases and private keys.

Deep Tide TechFlow News, May 11th, according to SlowMist disclosure, its security monitoring system MistEye detected a counterfeit TronLink Chrome MV3 extension targeting TRON wallet users with a double-layer phishing attack. The extension disguises itself as an official plugin through Unicode obfuscation and brand imitation. After installation, it prioritizes loading remote iframe pop-up pages to lure users into entering seed phrases, private keys, keystore files, and passwords, and transmits the information via same-origin interfaces to a Telegram Bot. The malicious infrastructure involved includes tronfind-api[.]tronfindexplorer[.]com and trx-scan-explorer[.]org, with the malicious extension ID being ekjidonhjmneoompmjbjofpjmhklpjdd. SlowMist recommends users uninstall the extension immediately; if sensitive information has been submitted, they should quickly transfer assets and abandon the original wallet.