If you trade crypto, check your browser for these dangerous add-ons right now

These days, all it takes is a compromised browser extension for attackers to get inside a crypto trading session that is already logged in. In a recent report, it’s exactly what security researchers say happened with three Chrome and Firefox add-ons targeting users of platforms like Axiom Trade and Padre.

The researchers at Socket found J7Tracker, VREO, and Orbit Tracker quietly collecting session tokens and wallet-related data from users. The extensions did not have to bypass any security on the device. Once they were running in the browser, they could take advantage of an already authenticated trading session.

If a user was logged into a trading account, the extensions could access active session tokens and wallet-related data held in the browser.

In their report, Socket explained the problem as: “malicious extensions abuse trusted browser marketplaces to gain execution inside authenticated Axiom Trade and Padre sessions, where they harvest session and wallet-related data.”

The stolen information was then packaged up and sent to servers controlled by the attackers. Orbit Tracker also contacted a Telegram bot to report whether it had managed to find valuable wallet data.

If you’ve been following the news lately, including our coverage, none of this would surprise you. We’ve covered how recent campaigns have involved Firefox add-ons intercepting crypto keyrings before local encryption could protect them, while another incident saw 19 extensions stripping browser security protections to capture user input.

Google has since removed J7Tracker, VREO, and related extensions such as GhostApe from the Chrome Web Store. When Socket published its findings, however, Orbit Tracker was still available on Firefox.

The bigger problem is that extensions don’t necessarily look suspicious when you install them. A tool that appears useful can end up with access to sensitive browser data, especially when it runs inside a logged-in trading session.

If you have any of these extensions installed, remove them, sign out of your active trading accounts, and consider moving your funds to a new wallet as a precaution. Needless to say, you should also consider carefully vetting any add-ons that you install.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.