{
 "tag": "countloader",
 "name": "Countloader",
 "group": "Other",
 "incidents": [
  {
   "slug": "silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "title": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses",
   "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "json": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "ethereum",
    "solana"
   ],
   "method": "clipboard-hijacker",
   "product": "Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)",
   "tags": [
    "bitcoin",
    "ethereum",
    "solana",
    "clipboard-hijacker",
    "clipper",
    "browser-extension",
    "chrome",
    "chromium",
    "countloader",
    "mcafee",
    "etherhiding",
    "windows"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-06-30",
   "closedAt": "2026-06-30",
   "updatedAt": "2026-06-30T12:00:00Z",
   "summary": "McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published."
  }
 ],
 "changes": [
  {
   "incident": "silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "incidentTitle": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-30",
   "title": "eSecurity Planet reports McAfee's findings on the Silent Swap clipper extension campaign.",
   "sourceUrl": "https://www.esecurityplanet.com/threats/silent-swap-uses-fake-chrome-extension-to-steal-crypto/",
   "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026"
  }
 ]
}