Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet Data
Source AlienVault OTX General
Description
Six Chrome and Firefox extensions linked through shared code, C2 infrastructure, and publishing history have been identified targeting cryptocurrency traders. Four malicious extensions steal authenticated session tokens and wallet data from Axiom Trade and Padre users, while two earlier extensions reveal a pattern of repackaging crypto trading tools. The extensions J7Tracker, VREO, and Orbit Tracker automatically retrieve user information, wallet bundles, Firebase tokens, and application state, then exfiltrate data to threat actor-controlled Vercel deployments. The campaign targets an active trading community with Axiom processing over $15 billion in volume across 650,000 wallets. The malicious code runs inside authenticated sessions, collecting localStorage, IndexedDB data, and API responses containing authentication tokens and wallet keys. Data is Base64-encoded and transmitted via browser navigation to avoid CORS restrictions, enabling account compromise and cryptocurrency theft.
Impact
The malicious extensions enable attackers to steal authenticated session tokens and wallet keys, leading to account compromise and potential theft of cryptocurrency assets from affected users. Given the targeted platforms process substantial trading volume and wallet counts, the impact can be significant for individual traders and the broader trading community. The exfiltration method circumvents typical browser security controls, increasing the risk of undetected data theft.
Defensive guidance
No official patches or vendor advisories are provided for these malicious extensions. Users should immediately uninstall the identified extensions (J7Tracker, VREO, Orbit Tracker, and related ones) and avoid installing unverified browser extensions, especially those related to cryptocurrency trading. Employ browser security best practices such as restricting extension permissions and monitoring for suspicious activity. Since these are malicious third-party extensions, remediation involves user action to remove them and vigilance against installing repackaged or untrusted extensions.
MITRE ATT&CK techniques
- T1059.007Command and Scripting Interpreter: JavaScript · Execution (opens in a new tab)
- T1204User Execution · Execution (opens in a new tab)
- T1036Masquerading · Stealth (opens in a new tab)
- T1528Steal Application Access Token · Credential Access (opens in a new tab)
- T1539Steal Web Session Cookie · Credential Access (opens in a new tab)
Indicators of compromise
Domains 4
- j7tracker.io
- cloudflare.bonto.run
- snapshot.xyz
- susi.bonto.run