Malicious Chrome Extension Drains Crypto via Secret API Keys

Socket’s Threat Research Team identified a malicious Chrome extension, “MEXC API Automator,” published on the Chrome Web Store that silently creates MEXC API keys with withdrawals enabled, masks the withdrawal permission in the UI, and exfiltrates the API key and secret to a hardcoded Telegram bot—allowing attackers to drain users’ accounts; code comments suggest a Russian-speaking actor linked to a broader SwapSushi-themed crypto theft campaign and Google has been notified.