Silent Swap: A Crypto Clipper Extension Campaign

Source record

McAfee Labs analysis of an active malicious Chromium-extension campaign that intercepted cryptocurrency wallet addresses and substituted attacker-controlled destinations.

Read the original source ↗

Claim-level citations (3)

• supportsSilent Swap injected a Chromium extension that replaced crypto wallet addresses: McAfee's reconstructed backend testing found deterministic attacker-controlled replacement-address mappings for multiple cryptocurrencies, while the unknown total number of attacker wallets prevented a reliable estimate of aggregate stolen funds.

  Wallet Substitution Logic and Analyzing Attacker Crypto Wallets, discussion of per-address mappings and loss-estimation limitation

• supportsSilent Swap injected a Chromium extension that replaced crypto wallet addresses: McAfee found that the installer targeted Chromium-family browser profiles including Chrome, Edge, Opera and Brave, modified Preferences or Secure Preferences and attempted to update integrity-related values so the malicious extension would load.

  Installer analysis around Figures 25-29 describing Chrome, Edge, Opera and Brave profile modification and Secure Preferences tampering

• supportsSilent Swap injected a Chromium extension that replaced crypto wallet addresses: The malicious extension monitored cryptocurrency addresses copied by the user and replaced matching destination addresses with attacker-controlled addresses before the victim pasted them.

  Wallet Substitution Logic, paragraphs describing copy-event interception and backend-provided replacement addresses