Silent Swap: A Crypto Clipper Extension Campaign

McAfee Advanced Threat Research describes an active, global browser-extension clipper campaign that silently sideloads a malicious Chromium extension (masquerading as “Google Notes”) via unsigned .NET and Golang installers to monitor clipboard activity and replace cryptocurrency addresses with attacker-controlled wallets; the threat abuses browser secure-preferences integrity checks to load without user consent and resolves its C2 dynamically via a smart contract on public blockchain (“EtherHiding”), increasing resilience and complicating takedown efforts, with telemetry showing widespread infections and multiple IOCs provided.