{
 "slug": "silent-swap-fake-google-notes-clipper-extension-jun-2026",
 "title": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses",
 "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026",
 "json": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026.json",
 "status": "closed",
 "severity": "medium",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "bitcoin",
  "ethereum",
  "solana"
 ],
 "method": "clipboard-hijacker",
 "product": "Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)",
 "tags": [
  "bitcoin",
  "ethereum",
  "solana",
  "clipboard-hijacker",
  "clipper",
  "browser-extension",
  "chrome",
  "chromium",
  "countloader",
  "mcafee",
  "etherhiding",
  "windows"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-06-30",
 "closedAt": "2026-06-30",
 "updatedAt": "2026-06-30T12:00:00Z",
 "summary": "McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published.",
 "timeline": [
  {
   "date": "2026-06-30",
   "title": "eSecurity Planet reports McAfee's findings on the Silent Swap clipper extension campaign.",
   "sourceUrl": "https://www.esecurityplanet.com/threats/silent-swap-uses-fake-chrome-extension-to-steal-crypto/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Silent Swap Uses Fake Chrome Extension to Steal Crypto",
   "url": "https://www.esecurityplanet.com/threats/silent-swap-uses-fake-chrome-extension-to-steal-crypto/",
   "publisher": "eSecurity Planet",
   "date": "2026-06-30"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nCheck your browser's extensions page. If you see a 'Google Notes' extension you did not install from the official store, or it has clipboard and all-sites access, you are affected, especially if you recently ran cracked or unsigned software.\n\n## What to do now\nRemove the extension and scan the PC; the installer may have changed browser settings, so a clean reinstall is safest. Compare recent outgoing transfers with the addresses you meant to use. Move funds if you copied any seed phrase or key while infected.\n\n## How to avoid this\nDo not run unsigned or cracked installers. Install extensions only from official stores and review their permissions. Confirm the full receiving address on a second screen or hardware wallet before sending.",
 "notes": null,
 "agentBrief": "# 'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses\n\n- Severity: Medium · Status: Still active (past)\n- Chains: Bitcoin, Ethereum, Solana · Method: Clipboard hijackers\n- Started: Jun 30, 2026 · Last update: Jun 30, 2026\n- Who/what: Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)\n\nMcAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published.\n\n## Am I affected?\nCheck your browser's extensions page. If you see a 'Google Notes' extension you did not install from the official store, or it has clipboard and all-sites access, you are affected, especially if you recently ran cracked or unsigned software.\n\n## What to do now\nRemove the extension and scan the PC; the installer may have changed browser settings, so a clean reinstall is safest. Compare recent outgoing transfers with the addresses you meant to use. Move funds if you copied any seed phrase or key while infected.\n\n## How to avoid this\nDo not run unsigned or cracked installers. Install extensions only from official stores and review their permissions. Confirm the full receiving address on a second screen or hardware wallet before sending.\n\n## Sources\n- Silent Swap Uses Fake Chrome Extension to Steal Crypto (eSecurity Planet, 2026-06-30): https://www.esecurityplanet.com/threats/silent-swap-uses-fake-chrome-extension-to-steal-crypto/\n\nFull record: https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026 · JSON: https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}