'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses
Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)
McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published.
Why this severity: Still active, a narrower target.
- Started
- Jun 30, 2026
- Closed
- Jun 30, 2026
- Method
- Clipboard hijackers
At risk
- Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)
- Bitcoin wallets
- Ethereum wallets
- Solana wallets
What to do now
- Remove the extension and scan the PC; the installer may have changed browser settings, so a clean reinstall is safest. Compare recent outgoing transfers with the addresses you meant to use. Move funds if you copied any seed phrase or key while infected.
Stay safe
Am I affected?
Check your browser's extensions page. If you see a 'Google Notes' extension you did not install from the official store, or it has clipboard and all-sites access, you are affected, especially if you recently ran cracked or unsigned software.
What to do now
Remove the extension and scan the PC; the installer may have changed browser settings, so a clean reinstall is safest. Compare recent outgoing transfers with the addresses you meant to use. Move funds if you copied any seed phrase or key while infected.
How to avoid this
Do not run unsigned or cracked installers. Install extensions only from official stores and review their permissions. Confirm the full receiving address on a second screen or hardware wallet before sending.
Timeline 1
eSecurity Planet reports McAfee's findings on the Silent Swap clipper extension campaign.
Source
News & write-ups ›1
How this method works
Malware on your computer or phone watches the clipboard and swaps any wallet address you copy for the attacker's. Read about clipboard hijackers →
Follow new drains and updates in your feed reader or Telegram RSS bot.