Google Takes Down Malicious Chrome Extensions that Steal Cryptocurrency Wallet Credentials

The internet giant has shut down 49 malicious Chrome extensions from the app marketplace. The extensions were found to have been stealing cryptocurrency keys and wallet details from users.

Google Targets Bogus Crypto Wallet Apps

The malicious extensions were discovered by Harry Denley, the Director of Security at the MyCrypto platform. Denley told ZDNet that most of these extensions are camouflaged as legitimate wallet apps. However, they contain malicious code that enables them to steal private keys, mnemonic phrases, and other relevant information. Denley clarified that some of the prominent wallet apps that these clones mimic include Trevor, KeepKey, Ledger, Exodus, and MyEtherWallet. These fake extensions all work identical to the original apps, but any details that customers enter on the fake extensions are immediately sent to the attackers’ server. He also added that the extensions appear to have been developed by a cybercrime group which he suspects to be from Russia. The security executive also pointed out that most of the thefts don’t happen immediately. Per an experiment he carried out, he realized that the hackers don’t actually steal funds as soon as they get the login credentials. He argues that it’s either the attackers haven’t gotten a grasp of how to automate their processes (and as such, is manually accessing each account), or they’re more interested in stealing from high-value targets alone.

Significant Threat to the Safety of the Industry

The threat of fake browser extensions in the crypto space has always been a prominent one. Last month, Ledger warned its users about a fake Chrome extension wreaking havoc and stealing funds. According to the French cryptocurrency wallet manufacturer, the malicious browser extension was requesting users’ recovery seeds, which would then be used to access their accounts. The fake extension in question tried to mimic Ledger Live, an extension that allows users to sync their Ledger wallets with a trusted device and approve transactions in Chrome.