Loading story…
Researchers reported an active Silent Swap campaign that distributes a fake "Google Notes" browser extension to steal cryptocurrency by replacing copied wallet addresses with attacker-controlled ones during transactions. The operation uses unsigned .NET and Golang installers to silently sideload the malicious extension into Chromium-based browsers including Chrome, Edge, Brave, and Opera, where it monitors clipboard activity and browser input for wallet strings across multiple blockchains and swaps them in real time.
The malware reportedly abuses Chromium trust mechanisms by altering Secure Preferences and related settings files, recalculating integrity values so the extension appears legitimately installed without user approval. Researchers said the campaign also uses EtherHiding-style blockchain-based command-and-control, querying a smart contract through public RPC infrastructure to resolve active C2 domains such as devops-offensive[.]cc and Zebregts[.]com, complicating detection and takedown. The activity has been linked to the CountLoader threat actor, with infections observed globally and a heavier concentration in India, while dynamic per-victim wallet mapping and published hashes, domains, payload URLs, and Bitcoin wallet indicators suggest a broad effort to monetize consumer cryptocurrency transactions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Gurucul published threat research on the Silent Swap campaign, describing a fake Google Notes browser extension that steals cryptocurrency by replacing wallet addresses and uses EtherHiding to retrieve command-and-control infrastructure from the blockchain. The report linked the activity to CountLoader and provided domains, a payload URL, SHA-256 hashes, and Bitcoin wallet addresses for detection and response.
McAfee reported an active campaign using unsigned .NET and Golang installers to sideload a malicious Chromium extension disguised as "Google Notes" that swaps copied cryptocurrency wallet addresses with attacker-controlled ones. The report also described abuse of Chromium trust mechanisms, blockchain-based C2 resolution, global infections with higher concentration in India, and links to CountLoader-related activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehackread.com
Open sourcecommunity.gurucul.com
Open sourcemcafee.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered multiple browser-extension campaigns that abused clipboard access to steal sensitive data and cryptocurrency. Socket found that Chrome and Firefox extensions branded as **VPN Go: Free VPN** initially behaved like legitimate proxy tools before later updates added clipboard monitoring, data chunking, session tagging, and HTTP exfiltration to hardcoded attacker-controlled IP addresses. The Chrome extension turned malicious in version `1.1`, while the Firefox add-on first did so in version `1.3.3`, indicating a staged update strategy designed to retain users while covert theft ran in parallel. A separate campaign tracked as **Silent Swap** used unsigned installers to deploy a fake **Google Notes** Chromium extension that replaced copied wallet addresses with attacker-controlled ones, enabling cryptocurrency theft across multiple coins. McAfee said the malware modified Chromium preference files and recalculated integrity values to avoid detection, while using **EtherHiding** and blockchain-based dead-drop resolution to fetch command-and-control details; the activity also overlaps with **CountLoader**, suggesting a shared operator. Google and Mozilla were notified about the malicious VPN-themed extensions, and users who copied passwords, wallet addresses, or other secrets while the add-ons were installed are advised to treat that data as compromised.
Jun 30, 2026
Mandiant reported a stealthy intrusion technique that used modified Windows `.lnk` shortcut files to launch legitimate Chromium-based browsers with a malicious extension loaded through the `--load-extension` switch. The approach allowed threat actors to maintain persistence while hiding activity behind normal browser execution, enabling theft of credentials, email data, and cryptocurrency-related information. Mandiant linked the method to multiple financially motivated intrusions in 2023 affecting organizations in the semiconductor, business marketing, financial investment, and telecom sectors. In one investigated campaign, a lure posing as **TradingView Desktop** delivered the **BRAINFOG** dropper, which installed the **RILIDE** browser extension, replaced Chrome shortcuts, and monitored access to services including **Coinbase**, **Binance**, **Gmail**, **Outlook**, **Yahoo Mail**, **Bybit**, and **OKX**. Mandiant also identified **BRAINLINK** as another dropper used to deliver RILIDE through a GitHub-hosted sample, and said infrastructure overlap tied the activity to the RILIDE command-and-control domain `ashgrrwt[.]click` and registrant organization **Kruglova LTD**.
Jun 29, 2026
Cyble researchers reported a newly identified Linux malware family, **ClipXDaemon**, that targets X11 desktop sessions by continuously monitoring clipboard contents (about every **200 ms**) and covertly replacing copied cryptocurrency wallet addresses with attacker-controlled ones to divert funds. The malware is designed to operate **without command-and-control (C2) infrastructure**, enabling direct monetization while reducing network-based detection opportunities; it uses standard **X11 APIs** to connect to the X server and perform clipboard tracking and manipulation. Infections were observed starting from a loader whose structure resembles the earlier Linux threat **ShadowHS**, including use of a *bincrypter*-generated script to decrypt and launch a memory-resident dropper that ultimately executes ClipXDaemon. The malware establishes persistence by appending an execution line (avoiding root privileges, scheduled tasks, or systemd services) and uses **double-fork daemonization** to evade inspection tools. Reported targeting includes multiple wallet formats—at least **Bitcoin, Ethereum, Litecoin, Monero, Tron, Dogecoin** (with additional monitoring noted for **Ripple** and **TON** in one report)—with wallet patterns and replacement data protected via encryption (including **ChaCha20** in the analyzed binary), and the payload was reported as undetected on VirusTotal at the time of analysis.
Jun 29, 2026