Malicious Chrome Extension Skims Solana Swaps with Hidden Transfers

A malicious Google Chrome extension named Crypto Copilot is allowing users to trade on the Solana network while covertly siphoning off fees into the attacker's wallet. The extension performs swaps via the decentralized exchange Raydium but includes additional instructions that affect users without their knowledge. Cybersecurity firm Socket has reported the issue and submitted a takedown request.

Key Takeaways

A harmful Chrome extension called Crypto Copilot allows for seemingly normal Solana trades while extracting hidden fees.
The extension uses Raydium for swaps but sends an extra fee to the attacker without clear user notification.
The extension has been active since June 2024 and has 15 users as of the report's publication.
This incident is part of a troubling trend, as similar malicious extensions have been identified in the past.

A Malicious Operation Disguised as Convenience

According to a report from cybersecurity firm Socket, the Google Chrome extension named Crypto Copilot permits users to trade on the Solana blockchain. However, behind the scenes, it uses the decentralized exchange Raydium to conduct swaps, adding an extra instruction that transfers SOL (the native currency of Solana) from users to the attacker’s wallet. Although users see only the swap details, the wallet confirmation screens summarize transactions without displaying the individual actions involved. As Socket highlighted, “Users sign what seems to be a single swap, but both instructions execute atomically on-chain.”

Crypto Copilot Extension

A Long-Lived Threat

The Cybersecurity firm Socket has taken action by submitting a takedown request for the harmful extension to the Chrome Web Store’s security team. Notably, this malicious extension has been around for a while, having been published on June 18, 2024. Despite its long life, it reportedly has only 15 users at the time of this report. Marketed as a convenience tool, Crypto Copilot claims to allow Solana traders to perform swaps directly from Twitter, enabling instant trading without the hassle of switching apps or platforms.

A History of Malicious Google Chrome Extensions

The extensive user base of Google Chrome and its adaptable design have made its extension ecosystem a frequent target for cryptocurrency scams. Earlier this month, Socket pointed out that one of the most popular crypto wallet extensions in the Chrome Web Store was draining user funds. Additionally, in late August, the decentralized exchange aggregator Jupiter detected another harmful Chrome extension that was emptying Solana wallets.

In June 2024, a trader from China lost a staggering $1 million after installing a Chrome plugin known as Aggr, which stole browser cookies to hijack accounts, including access to the trader’s Binance account.

Key Takeaways

A Malicious Operation Disguised as Convenience

A Long-Lived Threat

A History of Malicious Google Chrome Extensions

Related Reading