Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million       Get the Latest News Home Newsletter Webinars Home Threat Intelligence Vulnerabilities Cyber Attacks Webinars Expert Insights Awards    Resources Webinars Awards Free eBooks About Site About THN Jobs Advertise with us Contact/Tip Us  Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback! Follow Us On Social Media       RSS Feeds  Email Alerts Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses  Ravie Lakshmanan  Jun 30, 2026 Browser Security / Cryptocurrency Cybersecurity researchers have flagged an active browser extension campaign that is designed to steal cryptocurrency by stealthily replacing wallet addresses when unsuspecting users initiate a transaction. The cryptocurrency clipper activity has been codenamed Silent Swap by McAfee Labs. "The campaign is delivered through unsigned installers – observed in both .NET and Golang variants – that deploy a malicious Chromium extension masquerading as a benign 'Google Notes' utility," the cybersecurity company said in a technical report shared with The Hacker News. The unsigned .NET installer, named BaseZipInstaller, is designed to retrieve a ZIP archive, which serves as a foundation for the malicious browser extension by scanning the system for Chromium-based browsers. For each detected profile in those browsers, it forcibly terminates the browser process and injects the extension by modifying the Secure Preferences and Preferences files. The end goal of the extension is to act as a clipper that's capable of intercepting and manipulating wallet addresses copied into the system clipboard with the goal of rerouting the funds to an attacker-controlled wallet. To realize its goals, the bogus Google Notes extension requests users to grant it permissions to access the clipboard, all URLs, and the browsing history. Because most transactions on the blockchain are irreversible, an address swap can result in permanent financial loss. McAfee Labs said the activity overlaps with a prior CountLoader campaign that delivered a crypto clipper, with evidence pointing to the same threat actor behind both clusters. A McAfee Labs spokesperson told The Hacker News that the initial access mechanism involves victims running a malicious file that launches CountLoader, which then fetches and installs additional payloads, in this case, a rogue browser extension. "Our research did not conclusively identify whether those initial installers are primarily distributed through phishing, malvertising, or another social engineering technique, so we can't attribute the campaign to one specific distribution method," the spokesperson added. "However, we do know attackers have commonly used phishing email attachments, game cracks, and similar social engineering tactics to trick victims into installing CountLoader." What makes Silent Swap stand apart is the use of a technique called EtherHiding that uses the blockchain as a dead drop resolver to retrieve the active command-and-control (C2) server details. This allows the attacker to trivially update a smart contract value to point to the new domain instead of having to redeploy the malware itself. The second aspect revolves around the covert installation of the browser extension on Chromium-based browsers like Google Chrome, Microsoft Edge, Brave, and Vivaldi by modifying protected browser settings files. The attack, however, hinges on enabling the developer mode for newer versions of the browsers, something that a threat actor can accomplish through social engineering tactics. "Normally, these browsers store security verification data (hash/HMAC values) alongside sensitive settings to detect unauthorized changes," McAfee said. "The malware recalculates and updates these security values after tampering with the files, tricking the browser into believing the malicious extension was installed legitimately." "This allows the extension to bypass the normal extension web store installation process and load silently without user approval." The campaign's persistence and evasion posture has been characterized as deliberate and layered, with the primary focus being on maintaining low visibility to the end user and high resilience against takedown and static analysis. Persistence is established by registering the extension by altering the browser's Secure Preferences file so that it's loaded on subsequent browser launches without the need for a separate mechanism. In addition, the malware attempts to enable developer mode programmatically in Brave and Opera, and the installer is self-deleted after execution, effectively removing an indicator of initial compromise. Another evasion technique is the use of dynamic wallet substitution, which is responsible for fetching a replacement address corresponding to a victim's original address. "It sends the intercepted wallet address to the attacker backend and uses the response to dynamically substitute the original address," McAfee said. "If the backend request fails, the function falls back to a predefined hard-coded wallet address, ensuring uninterrupted malicious activity." For every wallet address matching patterns associated with Bitcoin (BTC), Ethereum, Bitcoin Cash, Ripple, and Dash, it's mapped to a unique attacker-controlled address on the server-side. In contrast, all submitted Solana addresses resolve to a single attacker address. As of writing, the Solana address has been found to have a balance of $1,902.45. "Each submitted address is mapped to a unique attacker-controlled address. Re-submitting the same original returns the same replacement, indicating a deterministic one-to-one mapping maintained server-side.  Telemetry data suggests that infections are globally distributed, with a higher concentration of victims reported in India. Other countries impacted by the campaign include the U.S., Brazil, Indonesia, and Spain. "This campaign is a concise illustration of where consumer-targeted cryptocurrency theft is heading," McAfee said. "Static attacker addresses have been replaced with a server-side, per-victim mapping. Fragile, hard-coded command-and-control domains have been replaced with a blockchain-resolved lookup that an operator can rotate with a single transaction." Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers The disclosure comes as Socket reported on a pair of malicious Chrome and Mozilla Firefox browser extensions, both carrying the name "VPN Go: Free VPN" on the Chrome Web Store and Firefox Add-ons marketplace. "Both extensions present themselves as free VPN tools and include visible proxy functionality," Socket researchers Kirill Boychenko and Kush Pandya said . "Under the hood, both also contain malicious clipboard theft logic that continuously monitors copied text and exfiltrates it to threat actor-controlled infrastructure." The behavior extends beyond wallet addresses, as it allows the operators to siphon all kinds of sensitive data, including passwords, authentication codes, API keys, OAuth tokens, and seed phrases. Further examination of the extensions has revealed a staged malicious update pattern, where the extension developer initially published a benign version to the extension storefront before introducing the clipboard-stealing capability through a subsequent update. While versions 1.1 and 1.2 of the Chrome extension have been found to exfiltrate clipboard data to "178.236.252[.]133," version 1.3 switches the exfiltration channel to a different IP address ("77.91.123[.]187"). In the case of its Firefox equivalent, 1.3.3 is the first version to include the clipboard stealer and send the information to "178.236.252[.]133." The 1.3.4 update moves the infrastructure to "77.91.123[.]187." Users who have installed either of the extensions are advised to remove them immediately and treat any secrets copied while the extension was active as compromised. "The static code is enough to show that the extensions were designed to function as proxy tools, not merely display a fake VPN interface," Socket said. "The proxy capability still increases risk because it can route browser traffic through threat actor-supplied infrastructure, expose plaintext HTTP traffic and connection metadata, and make the extension appear useful while the clipboard monitor runs in parallel." (The story was updated after publication on July 1, 2026, to include a response from McAfee Labs.) Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post. SHARE      Tweet  Share  Share  Share   Share on Facebook  Share on Twitter  Share on Linkedin  Share on Reddit  Share on Hacker News  Share on Email  Share on WhatsApp Share on Facebook Messenger  Share on Telegram SHARE  Browser Extension , Chromium , Clipboard Stealer , Command and Control , cryptocurrency , Firefox , Google Chrome , McAfee , Socket ⚡ Top Stories This Week ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts ⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks WhatsApp is Finally Getting Usernames to Help Keep Phone Numbers Private Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks 282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS ⭐ Featured Resources What 200+ Security Teams Reveal About Using IP Intelligence in 2026 Get Hands-On SANS Training for Today’s Cyber Defense and Offensive Security Challenges See What’s Really Exposed Across Your IT, OT, IoT, Cloud, and Mobile Assets Get Gartner’s Guide to AI Agent Supervision and Runtime Controls Cybersecurity Webinars Control Rogue AI How to Secure AI Agents Before They Go Rogue Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment. Register Build AI Securely How to Secure AI-Built Software at Machine Speed Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed. Register ⚡ Latest News Cybersecurity Resources 5 Steps to Secure Against Software Vulnerabilities Discovered by AI Models AI has emerged as a potent weapon in cybersecurity. Learn how to best safeguard your organization. How Do You Secure Autonomous AI Systems? Explore agentic AI, governance, and machine-speed response in San Francisco. Metasploit. Prompt Injection. Lateral Movement. SANS SEC504 - GCIH If you know the tools, you can stop the breach. 44 labs. SANS Virginia Beach this fall. ​ Expert Insights Articles Videos Beyond Blocking: Disrupting the Social Engineering Attack Chain  June 22, 2026 Read ➝ Building a Security Strategy for AI-Powered Ransomware Attacks  June 22, 2026 Read ➝ Identity Security in 2026: The Brutal Truth Enterprises Still Avoid  June 22, 2026 Read ➝ Why Runtime Scanning Is Too Late for Your CI/CD Supply Chain Security  June 15, 2026 Read ➝ Get the Latest News in Your Inbox Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free. Email Connect with us!  1,700,000 Followers  720,000 Followers  25,500 Subscribers  170,000 Followers  1,990,000 Followers 60,000 Followers Company About THN Advertise with us Contact Pages Webinars Awards Privacy Policy  RSS Feeds  Contact Us © 2026 The Hacker News. All Rights Reserved.

📌 来源: The Hacker News | 📅 2026-06-30