9 minmedium
Crypto Scam Extensions Masquerade as High-Profile Investors | Akamai
Nearly 30 malicious Chrome extensions impersonate famous investors like Warren Buffett to lure crypto users; non-English users redirected to wallet phishing pages stealing recovery phrases. The extensions share common code, infrastructure, and anti-analysis logic despite different publisher names and branding. English-speaking users see benign dashboards while non-English users are redirected to cryptocurrency wallet phishing pages. Attackers construct destination URLs character-by-character at runtime and use navigator.webdriver, screen resolution, and language checks to evade automated analysis.
Sens:7d
IOCs24
24domain
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block all listed extension IDs and domains in managed browser policies
- Audit installed browser extensions for listed extension IDs and remove matches
- Block listed phishing domains at web proxy and DNS filtering layers
Key Takeaways
- Campaign began March 2026 with nearly 30 extensions sharing identical code and infrastructure
- English-speaking users receive benign dashboards; non-English locale users get redirected to phishing
- Anti-analysis checks inspect navigator.webdriver, screen dimensions, and navigator.languages
- Destination URLs assembled character-by-character at runtime to evade static analysis
- Source code contains unusually verbose comments indicative of AI-assisted development
Attack Chain
- Initial Access: Users install malicious Chrome extensions from Web Store with publisher names impersonating famous investors
- Defense Evasion: Extension checks navigator.webdriver, screen resolution, and navigator.languages to detect analysis environments
- Discovery: Extension inspects browser locale settings to determine if user is English-speaking or non-English
- Execution: Non-English users are redirected to external phishing infrastructure; English users see benign dashboards
- Credential Access: Redirected users land on cryptocurrency wallet phishing pages requesting recovery phrases
- Exfiltration: Submitted recovery phrases give attackers full control over associated cryptocurrency wallets
Affected Systems
- Chrome Web Store browser extensions
- Users with non-English browser locale settings
- Cryptocurrency wallet users
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Browser extension behavior is opaque to traditional EDR; DOM manipulation and in-browser redirects may not generate process telemetry. |
| Network Visibility | Medium | Network sees redirect traffic and phishing page visits, but destination URLs are dynamically constructed at runtime. |
| Detection Difficulty | Hard | Locale-aware split behavior and runtime URL construction evade static analysis; English-locale benign behavior complicates automated review. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Browser extensions making outbound network requests to dynamically constructed URLs after passing navigator.webdriver checks (T1497.001, T1140) | Browser network request logs, DNS queries | Defense Evasion | Medium — legitimate extensions may check automation flags |
| Extensions exhibiting different behavior based on browser locale, redirecting only non-English users to external sites (T1036.005) | Extension behavior logs with locale context | Execution | Low — locale-dependent redirects are rare in legitimate extensions |
| Browser extensions with publisher names matching known public figures but unverified by the extension store (T1656) | Chrome Web Store extension inventory and publisher metadata | Initial Access | Low — legitimate public figures rarely publish browser extensions |
Required Log Sources
- Browser extension audit logs
- Chrome Web Store install logs
- DNS resolution logs
- Web proxy logs
- EDR process telemetry
Key Behavioral Indicators
- Extension making network requests to domains registered shortly before extension publication
- Browser extension checking navigator.webdriver property before executing redirect logic
- Extension constructing URLs character-by-character from code fragments at runtime
- Extension behaving differently based on navigator.languages and screen dimensions
- Multiple extensions sharing identical code despite different publisher names and branding
- Extension requesting broad permissions with publisher name matching a public figure
Control Gaps
- Chrome Web Store publisher names not verified against real-world identities
- Static code analysis misses dynamically constructed URLs assembled at runtime
- Locale-aware split behavior evades sandbox analysis in English-language environments
- Install-time review cannot detect post-installation behavior changes from back-end infrastructure
- Behavior-based extension monitoring not commonly deployed in enterprise environments
False Positive Assessment
Low — listed extension IDs and domains are campaign-specific; legitimate extensions rarely exhibit locale-dependent split behavior or runtime URL construction.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Deploy runtime browser extension monitoring to detect post-install behavior changes
- Enforce extension allowlisting via group policy or MDM browser management
- Monitor DNS queries for newly registered domains matching campaign patterns
User Protection
- Warn crypto users about extensions impersonating famous investors
- Instruct users to never enter wallet recovery phrases on web pages
- Enable browser extension permission review prompts for all users
Security Awareness
- Train users that browser extension publisher names are not verified against real identities
- Educate crypto wallet users that legitimate wallet software never requests recovery phrases online
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping8 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Stealth
Tactic
Discovery
Plain-Language Summary
Attackers published about 30 malicious browser extensions on the Chrome Web Store using names of famous investors like Warren Buffett to appear trustworthy. The extensions look harmless to English-speaking users but redirect users with non-English browser settings to fake cryptocurrency wallet pages that steal recovery phrases (the secret words needed to access a crypto wallet). Organizations should audit installed browser extensions and use tools that monitor extension behavior after installation rather than relying on app store reviews.
Additional IOCs
- Domains:
z-toolbox[.]online- Malicious domain for Z-Toolbox extensionswiftnote[.]online- Malicious domain for SwiftNote extensionswiftnotes[.]online- Malicious domain for SwiftNote extension variantswiftnotespro[.]online- Malicious domain for SwiftNote Pro extensionvisionarystudio[.]site- Malicious domain linked to campaign infrastructureghostpad[.]site- Malicious domain for GhostPad extensioncrytab[.]info- Malicious domain for CryptoTab extensiontimeanddate[.]homes- Malicious domain linked to campaign infrastructurenovahomesiu[.]site- Malicious domain linked to campaign infrastructureaikuiachuhai[.]site- Malicious domain linked to campaign infrastructureimtokensecurelocaltoolkit[.]blogspot[.]com- Blogspot subdomain for imToken extensionctrackerpro[.]sbs- Malicious domain for crypto tracker extensiontimeforge-concentration[.]blogspot[.]com- Blogspot subdomain for TimeForge extensiontrustpdfswift[.]blogspot[.]com- Blogspot subdomain for Trust PDF Swift extension
- Other:
[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Publisher identity email for Focus Time Tracker[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructure[email protected]- Impersonates Joseph Lubin; publisher identity email[email protected]- Publisher identity email for Trust-Wallet extension[email protected]- Impersonates Daniel Schneider; publisher email[email protected]- Support email linked to campaign infrastructure[email protected]- Publisher identity for Secure Password Generator Pro[email protected]- Support email linked to campaign infrastructure[email protected]- Support email linked to campaign infrastructuremgbkajajjhgmhchoajmomhcdmlndkofc- Malicious extension: Crypto Dashboard & Calculatordmnhoegpldfpfmfoignpmapmbffgkalj- Malicious extension: SwiftNotebdfeblcackbiefgceemmcklcgjmmemal- Malicious extension: PrivacyMode for Cryptoejbieagijpeanlkmjlpdbincpoecfifo- Malicious extension: Zynapsefcnpdjodobbplilcehceeiihdbkaohhp- Malicious extension: Z-Toolboxdpohdmekaccegbjbfgnpidkhcmcakhkb- Malicious extension: WorkFlow OmniPadmmbpjfigdeidddpkhpgbpoafiaefbkha- Malicious extension: MetaMask Extension (fake)ellfpjminfaokagphnohegiifhlccbkm- Malicious extension: OmniTool Prolkgmpcehbonlcpoemnakmamjfpfdakfa- Malicious extension: GhostPadgdfamnmplbehddebboejkohaognhphnd- Malicious extension: crypto privacy modejodgpofgbnifpjpikmagibgcfiipkgkb- Malicious extension: NexusFlow Sidebarcomglfkbkcippbiheejbaimphjngliab- Malicious extension: OmniFlow Propfgpfmdiepmhhhkpnciogjhccppbcfhk- Malicious extension: OmniFlow Sidebarochcpafcpkkocmlegiiaikfekjngjbif- Malicious extension: NovaClip Productivity Workspacecpaldpbeoonkiloiilchpeecafcjooad- Malicious extension: OmniPass Secure Generatorpdbkpnbkalelbdngijdaejgapfeciahc- Malicious extension: TaskMaster Smart Tododoholgnkopeogjamiklibcmbofnhckdm- Malicious extension: TradeLog Crypto Journaljiopaphnoebconjcblfkljoedjlplhbd- Malicious extension: TradeLog Pro Crypto Trackeramfamndhbbiaafhpclielacfailgflbi- Malicious extension: CryptoTab Pro Dashboardibhbpdmaejlapiadekfdmlklaojbkemb- Malicious extension: Trust-Wallet Secure Notes & Timerpfonmpmfmkbamnpckphpghoagglnenad- Malicious extension: Safepal-Wallet Secure Notes & Timercealpkapgiobhiafgnmgjkaeifcleabm- Malicious extension: Focus Time Trackerbhfnifoebenbpbnlmaddnkniocoaagfg- Malicious extension: Trust-Wallet Secure Notes & Timermbmcpcnfbpcmlcbankfgnecmmhjkeapb- Malicious extension: imToken Secure Local Toolkitelfbigacoidmjleehfjhgkahdndopcfj- Malicious extension: Trust-Wallet Secure Notes & Timergijdlcgcmadappinmgdgiihiepcgboaf- Malicious extension: Trust-Wallet Secure Notes & Timerdkkiccfndjjicfhjaoeeeiobbibnidmg- Malicious extension: TimeForgedbencngeccmgjbindcldfpcmlckkpnlc- Malicious extension: DeFi Asset Manager Prohiomcdgildjfmbabbiofclfechnfmlmn- Malicious extension: Text Case Converter Proepkgheklficclfoflikjbhcfdfgccoab- Malicious extension: Trust PDF Swift Convert & Editidfihpinagmbpjoonfkekcnflihfibeg- Malicious extension: Secure Password Generator Proiddfomgididbjilmmhannjkklpocjbdd- Malicious extension: Trust-Wallet Crypto & Bitcoin
Showing defanged values
- domainaikuiachuhai[.]siteMalicious domain linked to campaign infrastructure
- domainairdrop[.]investmentsPhishing redirect domain for cryptocurrency airdrop scams
- domainchromerabbypro[.]comImpersonates Rabby Wallet; redirect infrastructure for campaign
- domaincrytab[.]infoMalicious domain for CryptoTab extension
- domainctrackerpro[.]sbsMalicious domain for crypto tracker extension
- domaindefassetmanagerpro[.]storeMalicious domain for DeFi Asset Manager Pro phishing
- domainextensionwebchrome[.]spaceMalicious domain mimicking Chrome extension web infrastructure
- domainfocustimetracker[.]blogspot[.]comBlogspot subdomain abused for Focus Time Tracker extension
- domaingenerpassword[.]comMalicious domain for Secure Password Generator Pro extension
- domainghostpad[.]siteMalicious domain for GhostPad extension
- domainimtokensecurelocaltoolkit[.]blogspot[.]comBlogspot subdomain for imToken extension
- domainmarlist[.]onlineMalicious domain linked to extension campaign infrastructure
- domainnovahomesiu[.]siteMalicious domain linked to campaign infrastructure
- domainswiftnote[.]onlineMalicious domain for SwiftNote extension
- domainswiftnotes[.]onlineMalicious domain for SwiftNote extension variant
- domainswiftnotespro[.]onlineMalicious domain for SwiftNote Pro extension
- domaintimeanddate[.]homesMalicious domain linked to campaign infrastructure
- domaintimeforge-concentration[.]blogspot[.]comBlogspot subdomain for TimeForge extension
- domaintru[.]airdrop[.]investmentsSubdomain used for phishing redirects in campaign
- domaintrustpdfswift[.]blogspot[.]comBlogspot subdomain for Trust PDF Swift extension
- domaintworkai[.]comMalicious redirect infrastructure domain in campaign
- domainvisionarystudio[.]siteMalicious domain linked to campaign infrastructure
- domainwebwextension[.]storeMalicious domain mimicking browser extension store
- domainz-toolbox[.]onlineMalicious domain for Z-Toolbox extension