Malicious Browser Add‑on Targets imToken Users’ Private Keys

Socket’s Threat Research Team uncovered a malicious Chrome extension that impersonates the imToken wallet (extension ID bbhaganppipihlhjgaaeeeefbaoihcgi) and immediately redirects victims to a homoglyph-based phishing site (chroomewedbstorre-detail-extension.com) to harvest seed phrases, private keys, and local passwords via a remote configuration endpoint (jsonkeeper.com/b/KUWNE); IoCs and mitigation steps are provided.