{
 "tag": "chrome",
 "name": "Chrome",
 "group": "Other",
 "incidents": [
  {
   "slug": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "title": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "json": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "solana",
    "tron"
   ],
   "method": "malicious-extension",
   "product": "Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'",
   "tags": [
    "multi-evm",
    "solana",
    "tron",
    "malicious-extension",
    "chrome",
    "edge",
    "browser-extension",
    "extension-takeover",
    "seed-phishing",
    "clickfix",
    "ledger",
    "trezor",
    "metamask",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-08-30",
   "closedAt": null,
   "updatedAt": "2026-08-30T12:00:00Z",
   "summary": "Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available."
  },
  {
   "slug": "silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "title": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses",
   "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "json": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "ethereum",
    "solana"
   ],
   "method": "clipboard-hijacker",
   "product": "Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)",
   "tags": [
    "bitcoin",
    "ethereum",
    "solana",
    "clipboard-hijacker",
    "clipper",
    "browser-extension",
    "chrome",
    "chromium",
    "countloader",
    "mcafee",
    "etherhiding",
    "windows"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-06-30",
   "closedAt": "2026-06-30",
   "updatedAt": "2026-06-30T12:00:00Z",
   "summary": "McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published."
  }
 ],
 "changes": [
  {
   "incident": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "incidentTitle": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-08-30",
   "title": "BleepingComputer reported Socket's discovery of 19 malicious Chrome and Edge extensions; the Chrome versions were gone but one Edge version was still live.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026"
  },
  {
   "incident": "silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "incidentTitle": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-30",
   "title": "eSecurity Planet reports McAfee's findings on the Silent Swap clipper extension campaign.",
   "sourceUrl": "https://www.esecurityplanet.com/threats/silent-swap-uses-fake-chrome-extension-to-steal-crypto/",
   "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026"
  }
 ]
}