Malicious Chrome Extension Steals Wallet Login Credentials and Enables Automated Trading

A malicious Chrome extension named 'MEXC API Automator' distributed via the Chrome Web Store automatically enables withdrawal permissions when users create API keys on MEXC, visually hides that change via CSS and MutationObservers, scrapes newly created Access and Secret keys from the success modal, and silently exfiltrates them to a hardcoded Telegram bot and chat ID—enabling account takeover and fund theft; Socket.dev researchers flagged the extension as malware and linked it to actor 'jorjortan142'.