Security Firm: Malicious Chrome Extension 「Crypto Copilot」 Secretly Steals Funds from User's Solana Transactions

BlockBeats News, November 27th, according to Cointelegraph, cybersecurity firm Socket has discovered a malicious Chrome extension named "Crypto Copilot" that is surreptitiously siphoning funds from users' Solana transactions. This extension allows users to directly conduct Solana transactions from X social media platforms but injects additional instructions into each transaction, siphoning off at least 0.0013 SOL or 0.05% of the transaction amount.

Unlike typical wallet-draining malware, Crypto Copilot leverages the Raydium decentralized exchange to execute transactions while adding a second instruction to transfer SOL to the attacker's wallet, with the user interface only displaying a transaction summary, concealing the separate operation instruction. Since its release on June 18, 2024, the extension has only had 15 users. Socket has submitted a takedown request to the Chrome Web Store security team. Security experts remind users that the Chrome extension ecosystem has long been a prime target for cryptocurrency scams due to its large user base and extensible design.