Malicious imToken Chrome Extension Caught Stealing Mnemonics and Private Keys

**Malicious imToken Chrome Extension Steals Seed Phrases:** Socket’s Threat Research Team discovered a Chrome extension masquerading as a harmless hex color tool that impersonates imToken and redirects users to a remote-configured phishing page to collect mnemonic seed phrases and private keys; the report includes the phishing workflow, evasion tactics (homoglyphs), IOCs (extension ID, phishing domain, remote JSON payload, malicious script host), and mitigation recommendations to block and investigate the threat.