Google Removes 49 Phishing Extensions That Steal Cryptocurrency Data

Google not too long ago eliminated 49 phishing Google Chrome internet browser extensions after receiving reviews about their exercise.

Harry Denley, director of safety at cryptocurrency pockets startup MyCrypto, defined in an April 14 Medium post how he obtained the extensions faraway from Chrome’s retailer inside 24 hours with the assistance of phishing-specialized cybersecurity agency PhishFort. 

The eliminated extensions embrace ones that focused the homeowners of {hardware} wallets produced by Ledger, Trezor and KeepKey, and customers of software program wallets Jaxx, MyEtherWallet, Metamask, Exodus and Electrum.

The extensions triggered the customers to enter the credentials wanted to entry the pockets — comparable to mnemonic phrases, non-public keys and keystore information — and despatched them to unhealthy actors. Hackers have been then in a position to steal the crypto belongings contained within the wallets.

A few of the extensions additionally had faux five-star rankings within the Chrome extension retailer, however the critiques contained little to no information starting from “good,” “useful app” to “legit extension.” 

One of many extensions reportedly had the identical overview copied and pasted eight instances by totally different customers. The copypasta included an introduction to Bitcoin (BTC) and defined why MyEtherWallet — the extension’s focused pockets — was the popular pockets choice. It’s price noting that MyEtherWallet doesn’t really help Bitcoin.

One unhealthy actor managed most extensions

The investigation uncovered 14 management servers behind all of the extensions, however fingerprinting evaluation revealed that a few of the servers have been managed by the identical unhealthy actors, with the oldest area being linked to many different management servers. Denley subsequently concluded that the identical unhealthy actors have been behind a lot of the extensions.

A few of the domains used within the phishing campaigns have been comparatively outdated, however 80% of them have been registered in March and April 2020. Many of the extensions have been revealed on Chrome’s retailer this month.

Not the primary phishing extensions concentrating on crypto customers

This isn’t the primary time that the neighborhood has found a malicious Google Chrome browser extension concentrating on crypto customers. As Cointelegraph reported in late March, a Redditor warned the neighborhood that he misplaced some crypto belongings after falling sufferer to a faux Ledger extension.

Google Chrome extensions concentrating on crypto customers are so frequent, that earlier this month MyEtherWallet warned its person that its official extension was eliminated for allegedly containing malware. Thankfully, the extension was restored shortly after the group contacted Google to unravel the problem.