Severity: High
Summary
Researchers identified nine malicious Chrome extensions disguised as harmless utilities, including note-taking apps, stopwatches, and password generators, that impersonate cryptocurrency wallets to steal digital assets. The extensions retrieve remote JSON configuration over HTTPS to dynamically load fake wallet interfaces, enabling flexible infrastructure changes and evasion of URL-reputation checks. Their capabilities include seed-phrase theft, hardware-wallet data interception, clipboard hijacking, and cryptocurrency address swapping, potentially compromising both online and hardware wallets.
Indicators of Compromise (IOC) List
Domains/Urls | base-5c5d3-default-rtdb.firebaseio.com basebooksdatabase-default-rtdb.firebaseio.com basepad-8cf0e-default-rtdb.firebaseio.com baseplaning-default-rtdb.firebaseio.com robinhoodbudget-default-rtdb.firebaseio.com robinstopwatch-default-rtdb.firebaseio.com tokenimproject-default-rtdb.firebaseio.com tokenimextenstion-91922-default-rtdb.firebaseio.com zenfocusextension-default-rtdb.firebaseio.com base-web3-wallet-extension.pages.dev chromeextenstooedoxu74428.pages.dev edgeextenstion9827611.pages.dev extenstionrobin8771252628.pages.dev nomiextenstionw9716222.pages.dev vaultextenstionchrome981822.pages.dev zenextensionchrom198723.pages.dev |
Browser Extensions | bbljaeojdeehoihejgmdjgjmnnolgdbm dnbfneandcjphnkgcjkdkphmaoajiojh gbafgofiefjephjoodfphmojinnfiada jfegcjipmnolppcnpgpmfogkmooelibl knamebhlnelgjefbmjngodcgiknhmnhk mdbhibcfeakbnlfbmfedjppfkenpklne mkiebookdgphpeehoaaohajdcjohcfmb nhjjepfbhpdhehdeiolbnjembodcgaee ombjdobdekonhhipddhpcpdfflmdakfe |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "chromeextenstooedoxu74428.pages.dev" or url like "chromeextenstooedoxu74428.pages.dev" or siteurl like "chromeextenstooedoxu74428.pages.dev" or domainname like "base-web3-wallet-extension.pages.dev" or url like "base-web3-wallet-extension.pages.dev" or siteurl like "base-web3-wallet-extension.pages.dev" or domainname like "vaultextenstionchrome981822.pages.dev" or url like "vaultextenstionchrome981822.pages.dev" or siteurl like "vaultextenstionchrome981822.pages.dev" or domainname like "edgeextenstion9827611.pages.dev" or url like "edgeextenstion9827611.pages.dev" or siteurl like "edgeextenstion9827611.pages.dev" or domainname like "robinhoodbudget-default-rtdb.firebaseio.com" or url like "robinhoodbudget-default-rtdb.firebaseio.com" or siteurl like "robinhoodbudget-default-rtdb.firebaseio.com" or domainname like "baseplaning-default-rtdb.firebaseio.com" or url like "baseplaning-default-rtdb.firebaseio.com" or siteurl like "baseplaning-default-rtdb.firebaseio.com" or domainname like "nomiextenstionw9716222.pages.dev" or url like "nomiextenstionw9716222.pages.dev" or siteurl like "nomiextenstionw9716222.pages.dev" or domainname like "tokenimproject-default-rtdb.firebaseio.com" or url like "tokenimproject-default-rtdb.firebaseio.com" or siteurl like "tokenimproject-default-rtdb.firebaseio.com" or domainname like "basebooksdatabase-default-rtdb.firebaseio.com" or url like "basebooksdatabase-default-rtdb.firebaseio.com" or siteurl like "basebooksdatabase-default-rtdb.firebaseio.com" or domainname like "zenfocusextension-default-rtdb.firebaseio.com" or url like "zenfocusextension-default-rtdb.firebaseio.com" or siteurl like "zenfocusextension-default-rtdb.firebaseio.com" or domainname like "base-5c5d3-default-rtdb.firebaseio.com" or url like "base-5c5d3-default-rtdb.firebaseio.com" or siteurl like "base-5c5d3-default-rtdb.firebaseio.com" or domainname like "basepad-8cf0e-default-rtdb.firebaseio.com" or url like "basepad-8cf0e-default-rtdb.firebaseio.com" or siteurl like "basepad-8cf0e-default-rtdb.firebaseio.com" or domainname like "tokenimextenstion-91922-default-rtdb.firebaseio.com" or url like "tokenimextenstion-91922-default-rtdb.firebaseio.com" or siteurl like "tokenimextenstion-91922-default-rtdb.firebaseio.com" or domainname like "zenextensionchrom198723.pages.dev" or url like "zenextensionchrom198723.pages.dev" or siteurl like "zenextensionchrom198723.pages.dev" or domainname like "robinstopwatch-default-rtdb.firebaseio.com" or url like "robinstopwatch-default-rtdb.firebaseio.com" or siteurl like "robinstopwatch-default-rtdb.firebaseio.com" or domainname like "extenstionrobin8771252628.pages.dev" or url like "extenstionrobin8771252628.pages.dev" or siteurl like "extenstionrobin8771252628.pages.dev" |
Reference:
Fake Wallet Extensions Impersonate Crypto Wallets