Malicious Chrome Extension Drains Crypto via Secret API Keys

A malicious Google Chrome extension named MEXC API Automator has been exposed as a wallet-draining trap after being published on the Chrome Web Store on 1 September 2025 by an entity known as jorjortan142, according to Socket’s Threat Research Team. The extension appeared to assist cryptocurrency traders with managing API keys, but beneath its helpful facade it covertly hijacks user accounts on the MEXC exchange to drain funds.

The report states that the extension programmatically creates new MEXC API keys, enables withdrawal permissions, hides that permission in the user interface, and exfiltrates the resulting API key and secret to a hardcoded Telegram bot controlled by the threat actor. Its UI manipulation is designed so that withdrawal permissions appear disabled to the user while the server side remains enabled, allowing silent abuse.

The researchers noted inline Russian comments suggesting the threat actor is a Russian speaker and linked the operation to a broader crypto-focused threat cluster associated with the SwapSushi brand. Socket has notified Google of the extension’s presence.