Six malicious browser extensions for Chrome and Firefox, linked by shared code and command-and-control infrastructure, target cryptocurrency traders by stealing session tokens and wallet data from Axiom Trade and Padre users. Four of these extensions—J7Tracker, VREO, Orbit Tracker, and one other—automatically collect user information, wallet bundles, Firebase tokens, and application state data from browser storage and API responses during authenticated sessions. The data is Base64-encoded and exfiltrated via browser navigation to bypass CORS restrictions, sending it to attacker-controlled Vercel deployments. This enables attackers to compromise accounts and steal cryptocurrency. The campaign reflects a pattern of repackaging crypto trading tools and targets a high-volume trading community.

The malicious extensions enable attackers to steal authenticated session tokens and wallet keys, leading to account compromise and potential theft of cryptocurrency assets from affected users. Given the targeted platforms process substantial trading volume and wallet counts, the impact can be significant for individual traders and the broader trading community. The exfiltration method circumvents typical browser security controls, increasing the risk of undetected data theft.

No official patches or vendor advisories are provided for these malicious extensions. Users should immediately uninstall the identified extensions (J7Tracker, VREO, Orbit Tracker, and related ones) and avoid installing unverified browser extensions, especially those related to cryptocurrency trading. Employ browser security best practices such as restricting extension permissions and monitoring for suspicious activity. Since these are malicious third-party extensions, remediation involves user action to remove them and vigilance against installing repackaged or untrusted extensions.