Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses

McAfee Labs and Socket disclosed active campaigns that install malicious Chromium and Firefox extensions to steal cryptocurrency and clipboard data: 'Silent Swap' uses unsigned installers and modifies browser preference files to sideload a crypto-clipper extension while resolving C2 via a blockchain 'EtherHiding' dead-drop and performing server-side dynamic wallet substitutions; separate 'VPN Go' extensions stage updates to introduce clipboard-stealing code that exfiltrates sensitive data to attacker infrastructure. Victims are globally distributed; users are advised to remove affected extensions and consider any copied secrets compromised.