A deceptive Chrome extension called Safery: Ethereum Wallet has emerged as a serious threat to cryptocurrency users.
See also: Malicious Rust Crates steal Solana and Ethereum keys
It was published in the Chrome Web Store on November 12, 2024 and disguises itself as a secure Ethereum Wallet, while secretly stealing user origin phrases.
The sophisticated design of the malware allows attackers to gain full control of victims' cryptocurrency wallets and drain their digital assets.
The extension works with a sneaky approach. When users create or import a wallet, the extension extracts the seed phrase and encodes it into synthetic Sui blockchain addresses .
See also: Malicious npm packages mimic Flashbots & steal wallet keys
It then transmits tiny microtransactions of 0.000001 SUI to these encrypted addresses from a wallet controlled by threat actors. To observers, these appear as normal blockchain activity, but in reality contain hidden user data.
Security analysts at Socket.dev have identified the malicious extension and discovered its evasion tactics. Researchers noted that the backdoor uses BIP-39, converting each seed phrase word into numeric indices and packaging them into hexadecimal strings that resemble legitimate Sui wallet addresses.
This clever approach hides data within blockchain transactions, eliminating the need for traditional command and control servers.
See also: US: Charges against 12 people for crypto fraud
The threat is particularly dangerous because the extension appears legitimate in the Chrome Web Store. Users searching for Ethereum Wallet find it in the fourth list of results alongside reputable alternatives like MetaMask and Enkrypt, giving it a false sense of credibility.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
