Silent Swap Crypto Clipper Hides in Google Notes Extension
ID: fb9e75f0-3ba3-590c-9cfd-450f5f06d842
STIX ID: report--fb9e75f0-3ba3-590c-9cfd-450f5f06d842
Feed Name: securityonline.info
Threat Score
The report describes the 'Silent Swap' crypto-clipper campaign that distributes unsigned .NET and Golang installers which silently force-install a fake Google Notes Chromium extension to monitor the clipboard, replace copied cryptocurrency addresses with attacker-controlled wallets using server-side mappings and an EtherHiding smart-contract C2 resolution, and thereby steal funds from victims—telemetry and a referenced McAfee analysis indicate active theft with a notable concentration of victims in India.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.