SlowMist: TRON Users Beware of Phishing Attack Mimicking TronLink Extension

On May 11th, the SlowMist team issued a warning after uncovering a high-risk phishing campaign targeting TRON wallet users. The attackers built a fake Chrome extension mimicking the official TronLink wallet. They used Unicode bidirectional control characters and lookalike Cyrillic letters to spoof the extension’s name, tricking users into trusting it. Listed in the Chrome Web Store, the malicious extension has a name nearly identical to the real TronLink. It capitalizes on the genuine version’s high download numbers and positive reviews to lower regular users’ guard. The extension itself has minimal code—it only loads a full phishing page from a remote server. This “separate shell and core” attack chain makes it hard to spot malicious activity via standard static code analysis. The remotely loaded phishing page looks almost exactly like the real TronLink web wallet. It’s designed to trick users into entering their mnemonic phrases, private keys, Keystore files, and wallet passwords. When users submit this info, it’s instantly sent to the attacker via a Telegram bot. The phishing page also has anti-debugging features: it disables right-click menus, developer tools, drag-and-drop, and page printing. It redirects users based on their location and language (especially Russian speakers) to avoid automated security scans. SlowMist advises users to take these steps: 1. Immediately check and uninstall any suspicious extensions from unknown sources. 2. Clear your browser’s local storage data. 3. Watch for any unusual network requests. If your wallet information was accidentally leaked, create a new wallet right away and move all assets to a secure address.