Security Firm: Malicious Chrome Extension 「Crypto Copilot」 Secretly Steals Funds from User's Solana Transactions

On November 27th, as reported by Cointelegraph, the cybersecurity firm Socket has uncovered a malicious Chrome extension named "Crypto Copilot". This extension is stealthily draining funds from users' Solana transactions. It enables users to directly carry out Solana transactions from X social media platforms. However, it injects additional instructions into each transaction, siphoning off at least 0.0013 SOL or 0.05% of the transaction amount. Unlike common wallet-draining malware, Crypto Copilot utilizes the Raydium decentralized exchange to execute transactions and adds a second instruction to transfer SOL to the attacker's wallet. The user interface only shows a transaction summary, concealing the separate operation instruction. Since its release on June 18, 2024, the extension has only had 15 users. Socket has submitted a takedown request to the Chrome Web Store security team. Security experts remind users that the Chrome extension ecosystem has long been a prime target for cryptocurrency scams due to its large user base and extensible design.