Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses
An active browser extension campaign that aims to steal cryptocurrency by covertly changing wallet addresses when gullible victims start a transaction has been discovered by cybersecurity researchers.
McAfee Labs has given the cryptocurrency clipper behavior the code name Silent Swap.
The cybersecurity firm stated in a technical analysis provided with The Hacker News that the campaign is distributed via unsigned installers, which can be found in both.NET and Golang versions. These installers install a malicious Chromium extension that poses as a harmless "Google Notes" tool.
BaseZipInstaller, an unsigned.NET installer, scans the system for Chromium-based browsers in order to obtain a ZIP archive that forms the basis of the malicious browser extension. It forcibly ends the browser...