SlowMist exposes counterfeit Chrome extension phishing activity that can steal wallet credentials such as seed phrases and private keys

robot
Abstract generation in progress

Golden Finance reports that on May 11, according to SlowMist, its security monitoring system MistEye detected a counterfeit Chrome MV3 extension targeting TRON wallet users with a double-layer phishing attack.
The extension disguises itself as an official plugin through Unicode obfuscation and brand imitation. After installation, it prioritizes loading remote iframe pop-up pages to lure users into entering seed phrases, private keys, keystore files, and passwords, and transmits this data via same-origin interfaces to a Telegram Bot.
The malicious infrastructure involved includes tronfind-api[.]tronfindexplorer[.]com and trx-scan-explorer[.]org, with the malicious extension ID being ekjidonhjmneoompmjbjofpjmhklpjdd. SlowMist advises users to uninstall the extension immediately; if sensitive information has been submitted, they should quickly transfer assets and abandon the original wallet.

TRX0.09%
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pin