{
 "tag": "malicious-extension",
 "name": "Malicious browser extensions",
 "group": "Drain methods",
 "incidents": [
  {
   "slug": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "title": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "json": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "malicious-extension",
   "product": "Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons",
   "tags": [
    "multi-evm",
    "malicious-extension",
    "firefox",
    "browser-extension",
    "fake-wallet",
    "rabby",
    "okx-wallet",
    "seed-phrase-theft",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-05",
   "closedAt": null,
   "updatedAt": "2026-10-07T12:00:00Z",
   "summary": "Socket found 16 Firefox extensions posing as Rabby Wallet (branded 'Raabby WaIIet') and OKX Wallet ('Portal WALLET'). They captured 12- or 24-word recovery phrases and private keys during the wallet import step and sent them to attacker-run Cloudflare Workers. Mozilla removed them by 5 October 2026, but Socket links them to a crypto-theft extension campaign it first saw in August 2026, so new copies may appear. No loss figure has been published; anyone who imported a seed into one of them should treat that wallet as stolen."
  },
  {
   "slug": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "title": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "json": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "solana",
    "tron"
   ],
   "method": "malicious-extension",
   "product": "Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'",
   "tags": [
    "multi-evm",
    "solana",
    "tron",
    "malicious-extension",
    "chrome",
    "edge",
    "browser-extension",
    "extension-takeover",
    "seed-phishing",
    "clickfix",
    "ledger",
    "trezor",
    "metamask",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-08-30",
   "closedAt": null,
   "updatedAt": "2026-08-30T12:00:00Z",
   "summary": "Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available."
  },
  {
   "slug": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "title": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "json": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana",
    "bitcoin",
    "ethereum"
   ],
   "method": "malicious-extension",
   "product": "Trust Wallet Chrome extension v2.68",
   "tags": [
    "solana",
    "bitcoin",
    "ethereum",
    "malicious-extension",
    "trust-wallet",
    "browser-extension",
    "chrome-web-store",
    "seed-phrase",
    "leaked-api-key",
    "wallet",
    "supply-chain",
    "shai-hulud",
    "npm",
    "seed-phrase-theft"
   ],
   "amountUsd": 8500000,
   "victims": 2520,
   "startedAt": "2025-12-24",
   "closedAt": "2025-12-25",
   "updatedAt": "2025-12-31T12:00:00Z",
   "summary": "A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected."
  },
  {
   "slug": "cursor-contractshark-solidity-extension-dev-key-theft-aug-2025",
   "title": "Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key",
   "url": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025",
   "json": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The key-stealing extension was installed in Cursor, the AI code editor the developer used as a coding assistant; it read the .env file rather than abusing the AI itself."
   },
   "chains": [
    "ethereum"
   ],
   "method": "supply-chain",
   "product": "Cursor AI code editor users",
   "tags": [
    "ethereum",
    "supply-chain",
    "cursor",
    "ai-code-editor",
    "malicious-extension",
    "solidity",
    "env-file",
    "private-key",
    "developers",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1,
   "startedAt": "2025-08-13",
   "closedAt": "2025-08-13",
   "updatedAt": "2025-08-13T12:00:00Z",
   "summary": "Cointelegraph reported on 13 August 2025 that an Ethereum core developer's hot wallet was drained after he installed 'contractshark.solidity-lang', a fake Solidity extension for the Cursor AI code editor with over 54,000 downloads. The extension read his .env file and sent the private key to the attacker, who waited three days before emptying the wallet. The loss was a few hundred dollars because he kept only test funds there and his main holdings on hardware wallets. Keep keys out of .env files on development machines and use small, separate test wallets."
  },
  {
   "slug": "cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "title": "Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer",
   "url": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "json": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The malicious extension reached the victim through the extension marketplace used by Cursor, an AI-powered code editor; the AI features themselves were not exploited."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Cursor AI code editor users (Open VSX extensions)",
   "tags": [
    "multi-evm",
    "supply-chain",
    "cursor",
    "ai-code-editor",
    "open-vsx",
    "malicious-extension",
    "solidity",
    "screenconnect",
    "quasar",
    "infostealer",
    "developers",
    "ai"
   ],
   "amountUsd": 500000,
   "victims": 1,
   "startedAt": "2025-07-10",
   "closedAt": "2025-07-10",
   "updatedAt": "2025-07-10T12:00:00Z",
   "summary": "Kaspersky reported on 10 July 2025 that a blockchain developer lost about $500,000 in crypto after installing a fake Solidity extension in Cursor, an AI code editor built on VS Code that gets extensions from the Open VSX registry. The extension gave no Solidity support; it installed ScreenConnect remote-access software, then the Quasar backdoor and a stealer that took browser, email and wallet data, including seed phrases. The attackers used the seed phrases to drain the developer's wallets. Developers should vet editor extensions and never keep seed phrases or funded keys on a coding machine."
  }
 ],
 "changes": [
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-07",
   "title": "Socket published its analysis, linking the add-ons through a shared campaign marker to crypto-theft extensions it found in August 2026.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-05",
   "title": "Mozilla unpublished the 16 malicious extensions from the Firefox add-ons store.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "incidentTitle": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-08-30",
   "title": "BleepingComputer reported Socket's discovery of 19 malicious Chrome and Edge extensions; the Chrome versions were gone but one Edge version was still live.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-31",
   "title": "SecurityWeek reported Trust Wallet's post-mortem: the Shai-Hulud 2.0 worm leaked developer GitHub secrets; $8.5M was drained from 2,520 addresses; users who logged in between 24 and 26 December were affected; all affected users will be reimbursed.",
   "sourceUrl": "https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-27",
   "title": "Trust Wallet launched a compensation claims process for about $7M in losses and warned of fake compensation forms.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-26",
   "title": "CyberInsider reported that the exfiltration domain metrics-trustwallet[.]com had been registered days before the breach and was taken offline.",
   "sourceUrl": "https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-25",
   "title": "ZachXBT warned that over $6M had been stolen from hundreds of users; Trust Wallet confirmed the v2.68 incident and released the fixed v2.69.",
   "sourceUrl": "https://www.theblock.co/post/383735/trust-wallet-extension-incident",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-24",
   "title": "Malicious Trust Wallet extension v2.68 was published to the Chrome Web Store at 12:32 UTC using a leaked store API key, bypassing the normal release process.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "cursor-contractshark-solidity-extension-dev-key-theft-aug-2025",
   "incidentTitle": "Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-08-13",
   "title": "Cointelegraph reported that a malicious Cursor extension had taken an Ethereum core developer's private key and the hot wallet was drained the previous Sunday.",
   "sourceUrl": "https://cointelegraph.com/news/core-ethereum-devs-crypto-wallet-drained-ai-extension",
   "url": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025"
  },
  {
   "incident": "cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "incidentTitle": "Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-07-10",
   "title": "Kaspersky disclosed that a fake Solidity extension aimed at Cursor users led to about $500,000 in stolen crypto from a blockchain developer.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers",
   "url": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025"
  }
 ]
}