A new malicious addon that can insert a covert Solana transfer inside a swap transaction and move the money to an attacker-controlled cryptocurrency wallet has been found by cybersecurity experts on the Chrome Web Store.
On May 7, 2024, a user using under the handle “sjclark76” published the Crypto Copilot extension for the first time. According to the inventor, the browser add-on enables direct cryptocurrency trading on X with flawless execution and real-time information.As of this writing, the extension is still available for download and has 12 installs.
According to a study published on Tuesday by Socket security researcher Kush Pandya, the extension injects an additional transfer into each Solana swap behind the interface, siphoning at least 0.0013 SOL, or 0.05% of the trade amount, to a hardcoded attacker-controlled wallet.
In particular, the extension includes obfuscated code that is manipulated to inject an unreported SOL transfer into the same signed transaction read more about Chrome Extension Caught Injecting Hidden Solana Transfer Fees Into Raydium Swaps.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.