Fake TronLink Chrome Extension Steals Crypto Wallet Credentials

A sophisticated phishing campaign impersonating the TronLink Chrome extension hijacks an existing Chrome Web Store listing and loads attacker-controlled remote UI to collect and exfiltrate wallet credentials (mnemonics, private keys, keystores). The extension uses Unicode homoglyphs and bidirectional control characters to spoof branding, requests minimal permissions to evade review, delivers a Next.js replica of the wallet UI via an iframe, employs sandbox/researcher detection and geo-targeting, and sends stolen data to attacker infrastructure and a Telegram bot in real time.