Malicious Chrome Extension Targets Solana Traders
By: Isha Das
A recently uncovered malicious Google Chrome extension, known as Crypto Copilot, has been covertly siphoning fees from Solana traders using its deceptive functionalities. Unlike typical cyber threats that aim to drain entire cryptocurrency wallets, this extension subtly skims portions of Solana trades, making it a particularly insidious threat for users engaged in crypto trading.
According to a report by cybersecurity firm Socket, the extension has been designed to allow users to trade Solana (SOL) directly from their social media feeds on platform X. However, it adds an invisible fee to each transaction, directing a minimum of 0.0013 SOL or 0.05% of the total trade value to the creator's wallet. This sophisticated approach ensures the fraudulent fee goes unnoticed by most users, as the user interface presents only the swap details and importantly omits the added transaction instruction. Wallet confirmation screens also critically summarize transactions without displaying individual instructions, allowing the malicious activity to occur under the radar.
On the backend, Crypto Copilot utilizes the decentralized exchange Raydium to conduct swaps on behalf of users. However, this malicious extension appends a secondary transaction instruction transferring a small amount of SOL from the user's account to the attacker's wallet. This kind of fraud highlights a significant vulnerability in the way decentralized exchanges perform operations, where layered transaction instructions can be manipulated to the disadvantage of unsuspecting users.
For more general information on decentralized exchanges and how they operate, users can visit trusted resources like Ethereum.org or Solana's official page for additional learning. As the prevalence of such malicious software architectures grows, staying informed and cautious about third-party extensions and apps remains crucial for crypto traders. Users are advised to regularly review extensions for legitimacy and seek cybersecurity advice from trusted entities.
