Hidden Theft: ‘Crypto Copilot’ Chrome Extension Drains Solana Wallets on X

A new malicious Chrome extension named Crypto Copilot targets the Solana ecosystem, deceiving users into thinking they are executing legitimate trades while siphoning funds into an attacker's wallet. Discovered by Socket's Threat Research Team, the extension was published on June 18, 2024, and operates by injecting a hidden transfer fee into every Solana swap transaction. This fee, which is not disclosed to users, transfers a minimum of 0.0013 SOL or 0.05% of the trade amount to a hardcoded wallet.

The extension's interface only shows legitimate swap details, concealing the malicious activity. Socket has submitted a takedown request to Google, but the extension remains available on the Chrome Web Store.