Date: 09/29/2026
Severity: High
Summary
Researchers identified a coordinated Malicious Browser Extension campaign in which Chrome extensions disguised as browser games impersonate legitimate Crypto Wallets such as TronLink, Trust Wallet, and Ledger Wallet Extension. The extensions use Name Evasion techniques to hide their wallet-related names and contact Vercel-hosted C2 infrastructure to dynamically load fake wallet pages for Phishing and Cryptocurrency Theft. The server-controlled payload can be replaced without updating the extension, while stolen information is exfiltrated through Telegram, enabling flexible Credential Theft, Financial Fraud, and Social Engineering.
Indicators of Compromise (IOC) List
Domain/URLs | clock-seed-season-window.vercel.app quiet-courier-dispatch-map.vercel.app glass-orchard-bough-control.vercel.app paper-telescope-focus-desk.vercel.app pocket-loom-thread-archive.vercel.app northbound-needle-bearing.vercel.app mothlight-lantern-signal.vercel.app rain-thread-window-signal.vercel.app last-lighthouse-beacon-gate.vercel.app shadow-cabinet-umbra-gate.vercel.app |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "mothlight-lantern-signal.vercel.app" or url like "mothlight-lantern-signal.vercel.app" or siteurl like "mothlight-lantern-signal.vercel.app" or domainname like "shadow-cabinet-umbra-gate.vercel.app" or url like "shadow-cabinet-umbra-gate.vercel.app" or siteurl like "shadow-cabinet-umbra-gate.vercel.app" or domainname like "last-lighthouse-beacon-gate.vercel.app" or url like "last-lighthouse-beacon-gate.vercel.app" or siteurl like "last-lighthouse-beacon-gate.vercel.app" or domainname like "pocket-loom-thread-archive.vercel.app" or url like "pocket-loom-thread-archive.vercel.app" or siteurl like "pocket-loom-thread-archive.vercel.app" or domainname like "northbound-needle-bearing.vercel.app" or url like "northbound-needle-bearing.vercel.app" or siteurl like "northbound-needle-bearing.vercel.app" or domainname like "glass-orchard-bough-control.vercel.app" or url like "glass-orchard-bough-control.vercel.app" or siteurl like "glass-orchard-bough-control.vercel.app" or domainname like "paper-telescope-focus-desk.vercel.app" or url like "paper-telescope-focus-desk.vercel.app" or siteurl like "paper-telescope-focus-desk.vercel.app" or domainname like "clock-seed-season-window.vercel.app" or url like "clock-seed-season-window.vercel.app" or siteurl like "clock-seed-season-window.vercel.app" or domainname like "quiet-courier-dispatch-map.vercel.app" or url like "quiet-courier-dispatch-map.vercel.app" or siteurl like "quiet-courier-dispatch-map.vercel.app" or domainname like "rain-thread-window-signal.vercel.app" or url like "rain-thread-window-signal.vercel.app" or siteurl like "rain-thread-window-signal.vercel.app" |
Reference:
https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-09-25-Crypto-Wallet-Runtime-Impersonation-Extensions.txt