Google Deleted 49 Chrome Browser Extensions that were Hijacking Crypto Wallets !

By CryptoUser | CryptoPublisher | 24 May 2020

Google deleted 49 Chrome browser extensions that were hijacking crypto wallets, targeting users of Ledger, Trezor, Jaxx, MEW, MetaMask, and others. Some of the malicious extensions came with fake five-star reviews, and were phishing for mnemonic phrases, private keys, and keystore files.

Recently, investigation carried out by MyCrypto and PhishFort came across big campaigns pushing fake browser extensions to users and targeting well-known brands via Google Ads and other channels. Whilst this is not a new attack vector, the brands targeted were new.

Whilst the extensions all function the same, the branding is different depending on the user they are targeting. The brands researchers found targeted with malicious extensions are:

Ledger <https://www.ledger.com/>
Trezor <https://trezor.io/>
Jaxx <https://jaxx.io/>
Electrum <https://electrum.org/>
MyEtherWallet <https://myetherwallet.com>
MetaMask <https://metamask.io>
Exodus <https://www.exodus.io/>
KeepKey <https://shapeshift.io/keepkey/>

Essentially, the extensions were phishing for secrets — mnemonic phrases, private keys, and keystore files. Once the user has entered them, the extension sends an HTTP POST request to its backend, where the bad actors receive the secrets and empty the accounts.

Some of the extensions have had a network of fake users rate the app with 5 stars and give positive feedback on the extension to entice a user to download it. Most of the positive feedback by bad actors were low quality, such as “good,” “helpful app,” or “legit extension.” One extension did stand out by having the same “copypasta” around 8 times, authored by different users, sharing an introduction into what Bitcoin is and explaining why the [malicious] MyEtherWallet was their preferred browser extension (Note: MEW doesn’t support Bitcoin).

There was also a network of vigilant users who wrote legitimate reviews about the extensions being malicious — however, it is hard to say if they were victims of the phishing scams themselves, or just helping the community to not download. Reading reviews, and paying attention to negative reviews could be helpful in some instances.

Google Webstore has a report section and with MyCrypto's reports and with the assistance of PhishFort, they made the extensions removed within 24 hours.

In depth analysis suggests the malicious extensions started to hit the store slowly in February 2020, increased releases through March 2020, and then rapidly released more extensions in April 2020.

February 2020: 2.04% were published.
March 2020: 34.69% were published.
April 2020: 63.26% were published.

This means that either the detection is getting much better, or that the number of malicious extensions hitting browser stores to target cryptocurrency users is growing exponentially.

Further analysis suggests Ledger is the most targeted brand.