{"id":231741,"date":"2026-06-30T04:45:15","date_gmt":"2026-06-30T11:45:15","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=231741"},"modified":"2026-06-30T07:30:53","modified_gmt":"2026-06-30T14:30:53","slug":"crypto-clipper-wallet-swapping-browser-extension-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/","title":{"rendered":"Silent Swap: A Crypto Clipper Extension Campaign"},"content":{"rendered":"

Authored by Neil Tyagi<\/em><\/p>\n

Executive Summary<\/span><\/b>\u00a0<\/span><\/h2>\n

McAfee Advanced Threat Research has\u00a0identified\u00a0an active browser-extension campaign designed to steal cryptocurrency by silently substituting wallet addresses the moment a user\u00a0initiates\u00a0a transaction<\/strong>. The campaign is delivered through unsigned installers \u2014\u00a0observed\u00a0in both .NET and Golang variants \u2014 that deploy a malicious Chromium extension masquerading as a benign \u201cGoogle Notes\u201d utility.\u00a0<\/span>\u00a0<\/span><\/p>\n

This campaign is related to\u00a0a previous\u00a0blog published by\u00a0McAfee\u00a0Labs,\u00a0<\/span>Sinkholing CountLoader: Insights into Its Recent Campaign<\/span><\/i>,<\/span><\/a>\u00a0as the threat\u00a0actor\u00a0appears\u00a0to be\u00a0the\u00a0same\u00a0behind<\/span>\u00a0both\u00a0<\/span>operations<\/span>.<\/span>\u00a0In that earlier research, we\u00a0analyzed\u00a0a crypto clipper payload that was injected directly into\u00a0memory. Here, we examine a different variant of the final-stage payload: a browser-based malicious extension designed to intercept and manipulate cryptocurrency transactions.\u00a0<\/span>\u00a0<\/span><\/p>\n

In this report, we detail how the extension\u00a0operates\u00a0and provide a technical analysis of the mechanisms that make this threat particularly\u00a0unique. The\u00a0extension behaves as a clipboard-aware crypto clipper: it\u00a0monitors\u00a0copy-and-paste activity,\u00a0identifies\u00a0wallet addresses across multiple blockchains, and swaps them for attacker-controlled addresses just before the victim pastes\u00a0the content. Because most\u00a0Blockchain transactions are irreversible, even\u00a0a single uninterrupted execution is enough to cause permanent\u00a0financial loss.<\/span>\u00a0<\/span><\/p>\n

Two characteristics elevate this campaign above the typical clipper threat:<\/span>\u00a0<\/span><\/p>\n

    \n
  1. Chromium trust-layer abuse.<\/span><\/b>\u00a0<\/span><\/b>The installer secretly forces a malicious browser extension into Chromium-based browsers like Google Chrome, Brave, and Microsoft Edge by\u00a0modifying\u00a0protected browser settings files. Normally, these browsers store security verification data (hash\/HMAC values) alongside sensitive settings to detect unauthorized changes<\/span>.<\/span><\/b>\u00a0<\/span><\/b>The malware recalculates and updates these security values after tampering with the files, tricking the browser into believing the malicious extension was installed legitimately. This allows the extension to bypass the normal extension web store installation process and load silently without user approval. However for updated Chrome and edge browser, Victim must manually turn on the developer mode for the extension to load properly, but people with outdated versions of chromium based browsers, remain at high risk. Moreover, for latest versions as well threat attacker can employ social engineering tactics to enable developer mode.<\/span><\/li>\n
  2. Blockchain-resolved command-and-control<\/strong>. The extension does not\u00a0contain\u00a0a hardcoded C2 domain. Instead, it queries a public blockchain RPC endpoint, invokes a read-only smart-contract method, and decodes the response at runtime to reveal its active C2\u00a0observed at the time of analysis as\u00a0<\/span>Zebregts[.]com<\/span> \n

    This technique, often referred to as \u201cEtherHiding,\u201d\u00a0<\/strong>complicates\u00a0takedown\u00a0efforts\u00a0because the attacker can rotate infrastructure by updating a smart-contract value rather than redeploying malware.<\/span>\u00a0<\/span><\/li>\n<\/ol>\n

    McAfee telemetry\u00a0<\/span>indicates<\/span>\u00a0a globally distributed infection footprint with a pronounced concentration in India. The breadth of the geography suggests opportunistic\u00a0<\/span>targeting of<\/span>\u00a0consumer cryptocurrency users rather than a region-specific operation.<\/span><\/span>\u00a0<\/span><\/p>\n

    Geographical Prevalence\u00a0<\/span><\/span>\u00a0<\/span><\/h2>\n
    \"A
    Our research shows that these are the most affected regions of the globe.<\/figcaption><\/figure>\n

    Telemetry analysis\u00a0<\/span>indicates<\/span>\u00a0that\u00a0<\/strong><\/span><\/span>infections are globally distributed<\/span><\/span><\/strong>, with a significantly\u00a0<\/span><\/span>higher concentration\u00a0<\/span>observed<\/span>\u00a0in India<\/span><\/span>\u00a0compared to other regions.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    The widespread geographic presence highlights the campaign\u2019s broad reach, suggesting opportunistic targeting rather than a region-specific attack.<\/span><\/span>\u00a0<\/span><\/p>\n

    The Malicious Extension: \u201cGoogle Notes\u201d<\/span><\/span>\u00a0<\/span><\/h2>\n

    This malware is masquerading as a\u00a0<\/span>seemingly harmless<\/span>\u00a0Google Notes extension.<\/span><\/span>\u00a0<\/span><\/p>\n

    \"The
    Figure 1. This image shows the malicious extension at the center of this campaign<\/em><\/figcaption><\/figure>\n

     <\/p>\n

    The dropped extension presents as a minimalist, legitimate-looking note-taking application branded as \u201cGoogle Notes,\u201d complete with a clean icon and a functional (& simplistic) user interface. <\/span>\u00a0<\/span><\/p>\n

    The cover is calculated: a user who manually opens the extension finds something that behaves as advertised, dampening suspicion. The\u00a0extension\u2019s\u00a0malicious logic is implemented in background service-worker scripts and content scripts that\u00a0operate\u00a0entirely out of view of the UI.<\/span>\u00a0<\/span><\/p>\n

    A\u00a0major red flag\u00a0first appears when adding the extension, which\u00a0requests\u00a0<\/span><\/b>\u00a0security<\/span><\/b>\u00a0<\/span><\/b>permissions<\/span><\/b>\u00a0and access that<\/span><\/b>\u00a0are disproportionate to a\u00a0<\/span><\/b>typical\u00a0<\/span><\/b>notes\u00a0applicatio<\/span><\/b>n:<\/strong>\u00a0<\/span><\/p>\n

      \n
    • Access to all\u00a0URLs ,\u00a0granting content-script injection into every site the user visits.<\/span>\u00a0<\/span><\/li>\n
    • Browsing\u00a0history access.<\/span>\u00a0<\/span><\/li>\n
    • Read and write access to the clipboard.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

      Mitigation and Recommendations<\/span>\u00a0<\/span><\/h2>\n

      For Consumers<\/span>\u00a0<\/span><\/h3>\n
        \n
      1. Before confirming any cryptocurrency transaction,\u00a0<\/span>visually verify the first and last six characters of the\u00a0recipient\u00a0address<\/span><\/b>\u00a0against the original source \u2014 ideally on a separate device.\u00a0This single habit defeats the overwhelming majority of clipper attacks.<\/span>\u00a0<\/span><\/li>\n
      2. Install browser extensions exclusively from the official Chrome Web Store<\/span><\/b>, Edge Add-ons store, or equivalent. An extension that appears in your installed list without a clear memory of having installed it should be treated as suspicious.<\/span>\u00a0<\/span><\/li>\n
      3. Review the permissions granted to every installed extension<\/span><\/b>. A note-taking tool has no legitimate need for access to all websites, browsing history, or\u00a0the clipboard.<\/span>\u00a0<\/span><\/li>\n
      4. Avoid running unsigned executables\u00a0<\/span><\/b>obtained from non-authoritative sources, particularly those offering free or cracked versions of paid software \u2014 a common delivery vector for this category of installer.<\/span>\u00a0<\/span><\/li>\n
      5. Keep endpoint protection up to date and enabled<\/span><\/b>; McAfee customers are protected against this specific campaign as described below.<\/span>\u00a0<\/span><\/li>\n<\/ol>\n

        McAfee security solutions help safeguard users at multiple levels:<\/span>\u00a0<\/span><\/h3>\n

        1. McAfee detects this threat as CryptoStealer.NE and keeps our customers safe<\/span><\/b>\u00a0<\/span><\/h4>\n
        \"Figure
        Figure 2. This image shows McAfee Antivirus blocking this threat for consumers.<\/em><\/figcaption><\/figure>\n

        2. Malicious Download Protection<\/span><\/b><\/h4>\n

        The\u00a0installer\u2019s\u00a0behavior\u2014downloading and executing remote payloads\u2014is flagged and blocked\u00a0by McAfee\u00a0before infection completes.<\/span>\u00a0<\/span>All the malicious domains and\u00a0URLs\u00a0are blocked\u00a0by McAfee in our tests.<\/span>\u00a0<\/span><\/p>\n

        3. Network Protection<\/span><\/b><\/h4>\n

        Connections to known malicious infrastructure (C2 servers) are blocked\u00a0by McAfee, preventing Wallet address retrieval<\/span>\u00a0<\/span><\/p>\n

        4. Real-Time Threat Intelligence<\/span><\/b><\/h4>\n

        Because this threat was\u00a0identified\u00a0in McAfee telemetry, protections can be rapidly deployed to:<\/span>\u00a0<\/span><\/p>\n

          \n
        • Block similar variants<\/span>\u00a0<\/span><\/li>\n
        • Detect related infrastructure<\/span>\u00a0<\/span><\/li>\n
        • Protect customers globally<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

          How The Threat Campaign Works<\/span><\/span>\u00a0<\/span><\/h1>\n

          What the Malware Does\u00a0<\/span>\u00a0<\/span><\/h2>\n
            \n
          1. Installs\u00a0a\u00a0<\/span>browser\u00a0extension\u00a0silently (web extension sideloading)<\/span>\u00a0<\/span><\/li>\n
          2. Monitors what you copy and paste (especially crypto addresses)<\/span>\u00a0<\/span><\/li>\n
          3. Works when you are making a crypto transaction<\/span>\u00a0<\/span><\/li>\n
          4. Silently replaces the wallet address with the attacker\u2019s address<\/span>\u00a0<\/span><\/li>\n
          5. Your funds are sent to the attacker instead of the intended recipient<\/span>\u00a0<\/span><\/li>\n<\/ol>\n

            Because cryptocurrency transactions are typically\u00a0<\/span>non-reversible<\/span><\/b>, victims may permanently lose funds.<\/strong><\/span>\u00a0<\/strong><\/p>\n

            \"Figure
            Figure 3. How the extension works in a nutshell<\/em><\/figcaption><\/figure>\n

             <\/p>\n

            Key Capabilities Identified<\/span><\/span>\u00a0<\/span><\/h2>\n

            1. Silent Extension Installation<\/span><\/span>\u00a0<\/span><\/h3>\n

            The malware does not use the official browser store. Instead, it directly\u00a0modifies\u00a0browser files to make the extension appear installed.\u00a0(Sideloading Browser Extension)<\/span>\u00a0<\/span><\/p>\n

            This bypasses normal security prompts and user awareness.<\/span>\u00a0<\/span><\/p>\n

            \"Figure
            Figure 4. Procmon logs showing BaseZipInstaller (malicious web installer) writing into Chrome and Edge secure preference files<\/em><\/figcaption><\/figure>\n

            2. Full Browser Access<\/span><\/span>\u00a0<\/span><\/h3>\n
            \"Figure
            Figure 5. Chrome extension Permissions required<\/em><\/figcaption><\/figure>\n
            \"Figure
            Figure 6. Manifest file for web extension<\/em><\/figcaption><\/figure>\n

            The malicious extension requests excessive permissions such as:<\/span>\u00a0<\/span><\/p>\n

              \n
            • Access to all websites<\/span>\u00a0<\/span><\/li>\n
            • Reading browsing history<\/span>\u00a0<\/span><\/li>\n
            • Reading and\u00a0modifying\u00a0clipboard\u00a0content<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

              3. Crypto Address Interception<\/span><\/b><\/h3>\n

              The extension\u00a0contains\u00a0logic to detect wallet addresses across multiple cryptocurrencies, including:<\/span>\u00a0<\/span><\/p>\n

              \"Figure
              Figure 7. Hardcoded cryptocurrency Regex and fallback address<\/em><\/figcaption><\/figure>\n
                \n
              • The fallback wallet addresses shown in the code are not used for every transaction; instead, they serve as a backup mechanism when dynamic address retrieval from the attacker-controlled server fails.\u00a0<\/span>\u00a0<\/span><\/li>\n
              • Under normal operation, the extension fetches replacement addresses from a remote server, enabling dynamic and potentially per-victim wallet assignment.\u00a0<\/span>\u00a0<\/span><\/li>\n
              • Fallback addresses ensure the attack\u00a0remains\u00a0functional even if the command-and-control infrastructure is temporarily unavailable or blocked.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
                \"Figure
                Figure 8. Malicious extension performing dynamic crypto address resolution<\/em><\/figcaption><\/figure>\n
                  \n
                • This function\u00a0is responsible for\u00a0obtaining the attacker-controlled replacement wallet address corresponding to a victim\u2019s original address.\u00a0<\/span>\u00a0<\/span><\/li>\n
                • It sends the intercepted wallet address to the attacker backend and uses the response to dynamically substitute the original address.\u00a0<\/span>\u00a0<\/span><\/li>\n
                • If the backend request fails, the function falls back to a predefined hardcoded wallet address, ensuring uninterrupted malicious activity.<\/span>\u00a0<\/span><\/li>\n
                • 3J98t1Wxxxx is the address that was copied in the clipboard<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

                  4<\/span>.\u00a0<\/span>Detection evasion and stealth<\/span><\/span>\u00a0<\/span><\/h3>\n
                  \"Figure
                  Figure 8. Settings.js file which shows config<\/em><\/figcaption><\/figure>\n
                    \n
                  • The configuration includes a hardcoded API key, which is used by the extension to authenticate communication with attacker-controlled infrastructure.\u00a0<\/span>\u00a0<\/span><\/li>\n
                  • An RPC URL pointing to a public blockchain node is\u00a0leveraged\u00a0to dynamically resolve backend server information, allowing the attacker to hide critical infrastructure behind decentralized systems.\u00a0<\/span>\u00a0<\/span><\/li>\n
                  • The presence of a smart contract address and method\u00a0indicates\u00a0that the malware retrieves its command-and-control (C2) domain indirectly via blockchain queries, making takedown and tracking more difficult.<\/span>\u00a0<\/span><\/li>\n
                  • Blacklisted domains\u00a0contains\u00a0a list of blockchain inspection related websites where the web\u00a0extension\u00a0will not\u00a0work ,\u00a0this is done to not alert the victim while he is trying to paste his\u00a0own address and view the\u00a0balance\u00a0of his wallet or inspect his wallet transactions<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
                    \"Figure
                    Figure 9. Resolving attacker C2 domain via Ethereum smart contract (etherhiding)<\/em><\/figcaption><\/figure>\n
                    \"Figure
                    Figure 10. Request payload with Ethereum contract address<\/em><\/figcaption><\/figure>\n
                      \n
                    • Dynamic analysis revealed that the malware resolves its command-and-control domain via a blockchain smart contract, which returned the domain\u00a0<\/span>devops-offensive[.]cc<\/span><\/i><\/b>\u00a0at runtime.\u00a0<\/span>\u00a0<\/span><\/li>\n
                    • The response from the blockchain is decoded at runtime, revealing the active C2 domain (devops-offensive.cc).\u00a0<\/span>\u00a0<\/span><\/li>\n
                    • This domain is not hardcoded, enabling the attacker to update infrastructure without\u00a0modifying\u00a0the malware.\u00a0<\/span>\u00a0<\/span><\/li>\n
                    • The resolved domain is cached locally to\u00a0maintain\u00a0persistence and reduce repeated network queries.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
                      \"Figure
                      Figure 11. This image shows the long-encoded string with the malicious domain<\/em><\/figcaption><\/figure>\n

                      This Long<\/span><\/span>–<\/span><\/span><\/span>encoded string is decoded using this\u00a0<\/span>function<\/span> to give the final attacker domain.<\/span><\/span><\/p>\n

                      \"Figure
                      Figure 12. This image shows the final attacker domain<\/em><\/figcaption><\/figure>\n

                      Persistence and Evasion Techniques<\/span><\/span>\u00a0<\/span><\/h2>\n

                      The campaign\u2019s persistence and\u00a0<\/span>evasion<\/span>\u00a0posture is deliberate and layered. The operator has clearly\u00a0<\/span>optimized<\/span>\u00a0for two properties: low visibility to the end user, and high resilience against takedown and static analysis.<\/span><\/span>\u00a0<\/span><\/p>\n

                      Persistence<\/span>\u00a0<\/span><\/h3>\n
                        \n
                      • Extension registration through Secure Preferences tampering ensures the extension loads on every\u00a0subsequent\u00a0browser launch without requiring any auxiliary Windows persistence mechanism \u2014\u00a0<\/span>no registry Run keys, scheduled tasks, or services that endpoint hunters typically inspect.<\/span><\/i><\/b>\u00a0<\/span><\/li>\n
                      • Developer mode is enabled programmatically where\u00a0required, allowing unpacked extensions to persist without triggering the periodic \u201cunpacked extensions warning\u201d flow that Chromium displays to dissuade sideloading.<\/span>\u00a0<\/span><\/li>\n
                      • The cached C2 domain allows the extension to continue\u00a0operating\u00a0against a known-good backend even if the blockchain RPC endpoint is briefly unavailable.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

                        Evasion<\/span>\u00a0<\/span><\/h3>\n
                          \n
                        • The extension\u2019s visible identity \u2014 a simple \u201cGoogle Notes\u201d note-taking application \u2014 provides plausible cover against casual inspection of the installed extensions list.<\/span>\u00a0<\/span><\/li>\n
                        • Recomputed HMAC\u00a0<\/span>values satisfy Chromium\u2019s integrity verification, avoiding the \u201cextension installed by an unknown source\u201d warning banner that would otherwise alert the user.<\/span>\u00a0<\/span><\/li>\n
                        • The installer self-deletes after execution, removing the most obvious on-disk indicator of\u00a0<\/span>initial\u00a0compromise.<\/span>\u00a0<\/span><\/li>\n
                        • C2<\/span>\u00a0resolution through a public blockchain means that there is no persistent C2 domain observable in the malware bundle itself; network-based detections built against hardcoded indicators will not fire until the domain is resolved and contacted.<\/span>\u00a0<\/span><\/li>\n
                        • Multi-language installer variants (.NET and Golang) reduce the effectiveness of compile-artifact and binary-feature signatures.<\/span>\u00a0<\/span><\/li>\n
                        • Per-address dynamic wallet substitution means that published\u00a0attacker addresses\u00a0age rapidly and\u00a0do\u00a0not\u00a0generalize\u00a0into durable blocklist entries \u2014 the defender must block the backend service itself, not the addresses it dispenses.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

                          Wallet Substitution Logic<\/span><\/span><\/span>\u00a0<\/span><\/h2>\n

                          The clipper logic sits in two layers: a content-script layer that\u00a0monitors\u00a0clipboard activity and DOM input fields across every visited origin, and a background layer that communicates with the attacker backend to retrieve replacement addresses.<\/span>\u00a0<\/span><\/p>\n

                          When the extension\u00a0observes\u00a0a copy event, it\u00a0applies\u00a0a set of cryptocurrency-specific regular expressions to the clipboard payload. If a match is found, the intercepted address is transmitted to the attacker<\/span>\u2019s<\/span>\u00a0backend over an authenticated request (authenticated with the API key embedded in the configuration). The backend responds with a replacement address specific to the submitted original, and that replacement is written back to the clipboard, overwriting the legitimate address before the victim can paste.<\/span>\u00a0<\/span><\/p>\n

                          Testing against a reconstructed backend client \u2014 built by re-implementing the extension\u2019s request format and response-decoding logic in Python \u2014 produced a revealing\u00a0behavioural\u00a0profile:<\/span>\u00a0<\/span><\/p>\n

                            \n
                          • Bitcoin<\/span><\/b>\u00a0(BTC), Ethereum, Bitcoin Cash, Ripple, and Dash:\u00a0<\/span><\/b>Each\u00a0submitted\u00a0address is mapped to a unique attacker-controlled address. Re-submitting the same original returns the same replacement,\u00a0indicating\u00a0a deterministic one-to-one\u00a0mapping maintained\u00a0server-side.<\/span>\u00a0<\/span><\/li>\n
                          • Solana:\u00a0<\/span><\/b>All\u00a0submitted\u00a0addresses collapse to a single attacker address, suggesting the per-victim mapping feature is selectively implemented per chain<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

                            Analyzing<\/span>\u00a0Attacker Crypto Wallets<\/span><\/span>\u00a0<\/span><\/h2>\n

                            Based on the\u00a0code\u00a0snippets from the web extension responsible for retrieving replacement addresses, a Python script was prepared to programmatically extract attacker wallet addresses. The payload was crafted using the attacker’s own code, and the “get replacement address” snippet was lifted directly from it. The attacker’s logic for decoding data received from the C2 server was also faithfully reimplemented in the script.<\/span>\u00a0<\/span><\/p>\n

                            The script was then executed using a few test Bitcoin\u00a0(BTC)\u00a0wallet addresses. The results showed that for every Bitcoin address provided, a unique Bitcoin address was returned in response, and\u00a0all of\u00a0these returned addresses were\u00a0valid\u00a0BTC wallets. This\u00a0indicates\u00a0that for every BTC address supplied, the attacker dynamically generates a new wallet tied to that specific input address. Furthermore, when the same address was provided again, the same BTC address was returned \u2014 confirming that\u00a0<\/span>each\u00a0victim\u00a0BTC address is deterministically mapped to a single, specific attacker-controlled address<\/span><\/b>. While some of these attacker wallets\u00a0contained\u00a0funds and others were empty, the unknown total number of attacker wallets makes it difficult to put a reliable estimate on how much cryptocurrency has been stolen overall.<\/span>\u00a0<\/span><\/p>\n

                            The same\u00a0behavior\u00a0was\u00a0observed\u00a0for Ethereum, where different wallet addresses were returned for each input. Interestingly, when the script was tested with Solana addresses, only a single address was returned regardless of how many different inputs were provided. This suggests that the attacker has implemented the per-address mapping feature only for specific cryptocurrencies, while others fall back to a single static drop wallet. Because the Solana address is shared across all victims, a noticeable bump in its balance is visible. Additionally, one of the Ethereum addresses uncovered was found to be holding approximately 1,902 USD worth of funds.<\/span>\u00a0<\/span><\/p>\n

                            In summary, the cryptocurrencies<\/strong> for which unique per-victim wallet addresses are generated include Bitcoin, Ethereum, Bitcoin Cash, Ripple, and Dash.<\/strong><\/span>\u00a0<\/strong><\/p>\n

                            \"Fig
                            Fig 13. Payload was crafted as attacker code<\/em><\/figcaption><\/figure>\n
                            \"Fig
                            Fig 14. Getting the replacement address code snippet taken from attacker code<\/em><\/figcaption><\/figure>\n
                            \"Fig
                            Fig 15. Attackers’ logic of decoding received data from C2 was also implemented<\/figcaption><\/figure>\n

                            Running<\/span>\u00a0script with few test Bitcoin Wallet addresses<\/span><\/span>\u00a0<\/span><\/p>\n

                            \"Fig
                            Fig 16. Every unique Bitcoin address was returned and all addresses are valid BTC wallet addresses<\/em><\/figcaption><\/figure>\n
                            \"Fig
                            Fig 17. Similarly, Ethereum saw unique addresses<\/em><\/figcaption><\/figure>\n
                            \"Figure
                            Figure 18: Running Script for Test Solana Addresses<\/figcaption><\/figure>\n

                            Luckily for Solana we are getting only 1 address\u00a0<\/span>when given multiple\u00a0<\/span>addresses<\/span>. <\/span>This<\/span>\u00a0shows\u00a0<\/span>that the attacker has implemented this address mapping feature<\/span> only on specific cryptocurrencies<\/span><\/span>\u00a0<\/span><\/p>\n

                            \"Fig.
                            Fig. 19 Here you can see a bump in the balance amount<\/em><\/figcaption><\/figure>\n
                            \"Fig
                            Fig 20. The ETH address was found to have 1902 USD<\/em><\/figcaption><\/figure>\n

                            Technical\u00a0<\/span>Analysis for\u00a0<\/span>.net<\/span>\u00a0file (Extension installer)<\/span><\/span>\u00a0<\/span><\/h3>\n
                            \"Fig.
                            Fig. 21 BaseZipInstaller is a .NET installer which is unsigned<\/em><\/figcaption><\/figure>\n

                             <\/p>\n

                            \"Fig.
                            Fig. 22 Stored Config as seen in Dnspy<\/em><\/figcaption><\/figure>\n
                              \n
                            • The malware embeds a complete\u00a0configuration\u00a0JSON directly within the binary,\u00a0eliminating\u00a0the need to fetch initial setup data from external sources.\u00a0<\/span>\u00a0<\/span><\/li>\n
                            • This embedded configuration includes critical details such as API keys, backend server URL, targeted wallet extensions, and the full extension manifest with extensive permissions.\u00a0<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
                              \"Fig
                              Fig 23: Main function from where execution starts<\/em><\/figcaption><\/figure>\n
                                \n
                              • The installer retrieves and\u00a0<\/span>validates<\/span>\u00a0a remote ZIP archive<\/span>\u00a0(google-services<\/span>[<\/span>.<\/span>]<\/span>cc\/base<\/span>[<\/span>.<\/span>]<\/span>zip)<\/span>, which serves as the primary payload for deploying the malicious browser extension, marking the transition from\u00a0<\/span>initial<\/span>\u00a0infection to browser-level compromise.<\/span><\/span>\u00a0<\/span><\/li>\n<\/ul>\n
                                \"Fig.
                                Fig. 24 The extension is created at the following location in the system with files that are downloaded as base.zip.<\/em><\/figcaption><\/figure>\n
                                \"Fig.
                                Fig. 25: Dnspy showing the list of targeted browsers<\/em><\/figcaption><\/figure>\n
                                  \n
                                • The installer iterates through multiple Chromium-based browsers, including Chrome, Edge, Opera, and Brave,\u00a0identifying\u00a0available user profiles on the system.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                • For each detected profile, the malware forcibly\u00a0terminates\u00a0the browser process to safely\u00a0modify\u00a0configuration files without interference.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                • It then injects the malicious extension by directly\u00a0modifying\u00a0Secure Preferences and Preferences, enabling the extension to be loaded without user interaction.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
                                  \"more<\/div>\n
                                    \n
                                  • The malware\u00a0identifies\u00a0browser installation paths by querying standard system directories, enabling it to\u00a0locate\u00a0user data folders for Chrome, Edge, Opera, and Brave.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                  • It systematically\u00a0enumerates\u00a0browser profiles and specifically looks for the presence of the Secure Preferences file, which stores critical browser configuration and extension data.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                  • By targeting profiles with Secure Preferences, the malware ensures it\u00a0modifies\u00a0only valid browser environments, increasing the reliability of extension injection.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
                                    \"We
                                    We can see writefile Event on Secure preferences file of chrome and MS Edge , when details of downloaded extension are written to those config files<\/em><\/figcaption><\/figure>\n
                                    \"Fig
                                    Fig 27 Attacker logic to resign the secure preference files<\/em><\/figcaption><\/figure>\n
                                      \n
                                    • The malware reads and\u00a0modifies\u00a0the\u00a0browser\u2019s\u00a0Secure Preferences file, which controls installed extensions and their trust state.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                    • It injects the malicious extension into the configuration and\u00a0attempts\u00a0to re-sign the modified data, making the changes appear legitimate to the browser\u2019s integrity checks.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                    • The updated configuration is then written back to disk, ensuring the extension is loaded automatically and persists across browser restarts.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
                                      \"Fig
                                      Fig 27B :Extension path is added to chrome secure preferences file<\/em><\/figcaption><\/figure>\n
                                      \"Fig
                                      Fig 28: Logic to Manipulate defenses of Brave Bowser<\/em><\/figcaption><\/figure>\n
                                        \n
                                      • For browsers such as Brave and Opera, the malware injects the malicious extension directly into the\u00a0browser\u2019s\u00a0configuration by adding entries under the\u00a0extensions.settings\u00a0(or\u00a0extensions.opsettings) section.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                      • It also updates integrity-related fields (protection.macs) to make the injected extension appear trusted by the browser.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                      • Additionally, the malware\u00a0attempts\u00a0to enable developer mode programmatically, allowing unpacked extensions to run with fewer restrictions.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
                                        \"Fig
                                        Fig 29: Attacker logic to get device ID used to further calculate integrity Values<\/em><\/figcaption><\/figure>\n
                                          \n
                                        • The malware\u00a0attempts\u00a0to recompute browser integrity signatures by generating new MAC (Message Authentication Code) values for the modified Secure Preferences file.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                        • It uses system-specific identifiers, such as the machine SID, combined with a seed value to mimic Chrome\u2019s internal verification mechanism.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                        • By recalculating these integrity checks (macs and\u00a0super_mac), the malware tries to make its unauthorized modifications appear legitimate to the browser.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
                                          \"Figure
                                          Figure 30 Self-Deletion Logic<\/em><\/figcaption><\/figure>\n
                                            \n
                                          • The malware includes a self-deletion mechanism designed to remove the installer executable after successful execution.\u00a0<\/span>\u00a0<\/span><\/li>\n
                                          • It launches a hidden command prompt process that delays execution briefly before\u00a0deleting\u00a0the original file from\u00a0disk.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

                                            Conclusion<\/span>\u00a0<\/span><\/h2>\n

                                            This campaign is a concise illustration of where consumer-targeted cryptocurrency theft is heading. The operator has taken the oldest and simplest category of crypto malware \u2014 the clipper \u2014 and quietly upgraded three of its weakest links. Static attacker addresses have been replaced with\u00a0a server-side, per-victim mapping. Fragile, hardcoded command-and-control domains have been replaced with a blockchain-resolved lookup that an operator can rotate with a single transaction. And a fragile dropper has been replaced with a Chromium extension that lives inside the user\u2019s most trusted application, loaded under the browser\u2019s own integrity signature.<\/span>\u00a0<\/span><\/p>\n

                                            McAfee will continue to track this campaign and related infrastructur<\/strong>e. Our customers are protected by existing detections and will benefit from telemetry-driven updates as new variants and rotated infrastructure are identified.<\/span>\u00a0<\/span><\/p>\n

                                            Indicators of Compromise<\/span><\/span> (IOC)<\/span><\/h2>\n\n\n\n\n\n\n\n\n\n\n
                                            Type<\/span><\/b>\u00a0<\/span><\/td>\nCategory<\/span><\/b>\u00a0<\/span><\/td>\nValue<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
                                            SHA-256<\/span>\u00a0<\/span><\/td>\n.NET Installer (BaseZipInstaller)<\/span>\u00a0<\/span><\/td>\n2735e12030c195fb5454e4736c51b55b59664b93cae9f4bd5317afcd9c2af0bf<\/span>\u00a0<\/span><\/p>\n

                                            053620962047f50a91c6e8d1a6519eccc41fab51473f033086b4d816abe8bcb0<\/span>\u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/td>\n<\/tr>\n

                                            SHA-256<\/span>\u00a0<\/span><\/td>\nGolang-compiled Installer Variant<\/span>\u00a0<\/span><\/td>\n11be4c47ff049322de41743f62544cafd32d67e24ad653b7ebedf8ebd63e0962\u2003\u2003<\/span>\u00a0<\/span><\/p>\n

                                            1432393691b415d0cd4680d9cee73e60896fbe63300d9f0355c96e91817e4b1d\u2003\u2003<\/span>\u00a0<\/span><\/td>\n<\/tr>\n

                                            URL<\/span>\u00a0<\/span><\/td>\nPayload distribution<\/span>\u00a0<\/span><\/td>\nhxxps:\/\/google-services[.]cc\/base[.]zip<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
                                            Domain<\/span>\u00a0<\/span><\/td>\nCommand-and-Control (resolved via smart contract)<\/span>\u00a0<\/span><\/td>\ndevops-offensive[.]cc<\/span>\u00a0<\/span><\/p>\n

                                            Zebregts[.]com<\/span>\u00a0<\/span><\/td>\n<\/tr>\n

                                            BTC wallet<\/span>\u00a0<\/span><\/td>\nCrypto wallet<\/span>\u00a0<\/span><\/td>\n3JvDBvKbS6YYMKjV3R9e9Zfd67f467fNLy<\/span>\u00a0<\/span><\/p>\n

                                            1BbhVBxpniuZuAL1gGZnEMdQhmz9JGWpyT<\/span>\u00a0<\/span><\/p>\n

                                            3AcPNVh7NyESwX3ECymy3rkdH4Ke2c26Tj<\/span>\u00a0<\/span><\/p>\n

                                            1BVTrB47erypG3tevi1U9Fv6BbNUBEiuiX<\/span>\u00a0<\/span><\/td>\n<\/tr>\n

                                            Artifact<\/span>\u00a0<\/span><\/td>\nSideload target<\/span>\u00a0<\/span><\/td>\nChromium Secure Preferences file (Chrome, Edge, Brave, Opera profiles)<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
                                            Extension files<\/span>\u00a0<\/span><\/td>\nmanifest.json<\/span> \u00a0<\/span><\/p>\n

                                            crypto-patterns.js<\/span>\u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            Interceptor.js<\/span>\u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            content-script.j<\/span> \u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            cache.js<\/span> \u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            domain-resolver.js<\/span>\u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            service-worker.js<\/span>\u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            api-client.js<\/span>\u00a0<\/span><\/td>\n

                                            		ed2599d6a8f30d5eaf14ad7f855aece0acdf7efa4a148eb18e4d9f0d8e2cd90c<\/span> \u00a0<\/span><\/p>\n

                                            daf82c67e8e5df6bbd5370172ac9374aa7dce48af05496e8ec3dba7b602c619b<\/span> \u00a0<\/span><\/p>\n

                                            6eb2f07265dd95cacd39dfcf0705786b97f3e173cf4e9b3dfe7bad141c9a9dd5<\/span>\u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            a2ffdbedc5c9f5400a2b1cf5d35f5ec1df06a74d0345f1035bcf75d36ed73e01<\/span> \u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            eb84ba4a0cd95655a021865d4fec93ae3393f86cc9848810ed0b49035b1c5e2c<\/span> \u00a0<\/span><\/p>\n

                                            6aaba685669d779ef8be8f7f4231096cfafd0ef386f3897c5e2106c177724fc8<\/span> \u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            2599064901308a97540af29197ed0b38702bbee38d6dbbfa61cf9eb5878353f3<\/span> \u00a0<\/span><\/p>\n

                                            ab450927b37e1b68e2be68832c354ac600e86e2545a904d4ca0ea283f2600cc2<\/span> \u00a0<\/span><\/p>\n

                                            \u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"

                                            Authored by Neil Tyagi Executive Summary\u00a0 McAfee Advanced Threat Research has\u00a0identified\u00a0an active browser-extension campaign designed to steal cryptocurrency by silently…<\/p>\n","protected":false},"author":695,"featured_media":209097,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[10667,10661,1838,12,442],"tags":[],"coauthors":[4136,16933],"class_list":["post-231741","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-news","category-internet-security","category-mobile-security","category-family-safety","category-mcafee-labs"],"acf":[],"yoast_head":"\nSilent Swap: A Crypto Clipper Extension Campaign | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Researchers uncover browser extension malware that steals cryptocurrency by swapping wallet addresses during transactions.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Silent Swap: A Crypto Clipper Extension Campaign | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Researchers uncover browser extension malware that steals cryptocurrency by swapping wallet addresses during transactions.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-30T11:45:15+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-30T14:30:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/02\/Thumb.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"600\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"McAfee Labs, Neil Tyagi\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs, Neil Tyagi\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Silent Swap: A Crypto Clipper Extension Campaign\",\"datePublished\":\"2026-06-30T11:45:15+00:00\",\"dateModified\":\"2026-06-30T14:30:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/\"},\"wordCount\":3565,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/02\/Thumb.jpeg\",\"articleSection\":[\"Security News\",\"Internet Security\",\"Mobile Security\",\"Family Safety\",\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/\",\"name\":\"Silent Swap: A Crypto Clipper Extension Campaign | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/02\/Thumb.jpeg\",\"datePublished\":\"2026-06-30T11:45:15+00:00\",\"dateModified\":\"2026-06-30T14:30:53+00:00\",\"description\":\"Researchers uncover browser extension malware that steals cryptocurrency by swapping wallet addresses during transactions.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/02\/Thumb.jpeg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/02\/Thumb.jpeg\",\"width\":600,\"height\":400},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Silent Swap: A Crypto Clipper Extension Campaign\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Silent Swap: A Crypto Clipper Extension Campaign | McAfee Blog","description":"Researchers uncover browser extension malware that steals cryptocurrency by swapping wallet addresses during transactions.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Silent Swap: A Crypto Clipper Extension Campaign | McAfee Blog","og_description":"Researchers uncover browser extension malware that steals cryptocurrency by swapping wallet addresses during transactions.","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2026-06-30T11:45:15+00:00","article_modified_time":"2026-06-30T14:30:53+00:00","og_image":[{"width":600,"height":400,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/02\/Thumb.jpeg","type":"image\/jpeg"}],"author":"McAfee Labs, Neil Tyagi","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs, Neil Tyagi","Est. reading time":"18 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Silent Swap: A Crypto Clipper Extension Campaign","datePublished":"2026-06-30T11:45:15+00:00","dateModified":"2026-06-30T14:30:53+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/"},"wordCount":3565,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/02\/Thumb.jpeg","articleSection":["Security News","Internet Security","Mobile Security","Family Safety","McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/","name":"Silent Swap: A Crypto Clipper Extension Campaign | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/02\/Thumb.jpeg","datePublished":"2026-06-30T11:45:15+00:00","dateModified":"2026-06-30T14:30:53+00:00","description":"Researchers uncover browser extension malware that steals cryptocurrency by swapping wallet addresses during transactions.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/02\/Thumb.jpeg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/02\/Thumb.jpeg","width":600,"height":400},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/crypto-clipper-wallet-swapping-browser-extension-malware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Silent Swap: A Crypto Clipper Extension Campaign"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/231741","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=231741"}],"version-history":[{"count":17,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/231741\/revisions"}],"predecessor-version":[{"id":232632,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/231741\/revisions\/232632"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/209097"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=231741"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=231741"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=231741"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=231741"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}