The malicious Google Chrome extension "Crypto Copilot" steals Solana exchange funds by hiding additional transfers.

PANews reported on November 28 that cybersecurity company Socket disclosed in a report released on Tuesday that a malicious Google Chrome extension named Crypto Copilot allows users to trade on the Solana blockchain through posts on social media platform X, while secretly siphoning fees from each trade exchange into the creator's wallet. The extension executes exchange operations for users using the decentralized exchange Raydium, while appending a hidden transfer instruction that moves Solana coins from the user's account to the attacker's account. Unlike typical malware that attempts to steal the entire wallet balance, this extension siphons at least 0.0013 Solana coins (about 0.05% of the transaction amount) from each trade. The user interface only displays transaction exchange details, while the wallet confirmation interface summarizes the transaction without showing specific instructions, leading users to believe they are only signing a transaction exchange, when in fact they are simultaneously authorizing both the exchange and the fund transfer. Although the extension has only accumulated 15 users since its release on June 18, 2024, it still exposes the security risks present in the browser extension ecosystem.