Socket Chrome-extension theft cluster

Socket research posts on additional Chrome Web Store malware: seed-phrase
exfil, hidden Solana swap fees, affiliate hijacking, Meta Business Manager
exports plus TOTP seeds, MEXC API keys, Phantom Shuttle VPN intercept,
and five extensions for HR/ERP session hijacking.

Mapped techniques

T0109 Publish malicious artifact
T0136 Brandjacking
T0184 Harvesting sensitive information from files

supply-chain campaign

T0109 · Resource Development · Publish malicious artifact

Multiple Chrome Web Store listings.

T0136 · Initial Access · Brandjacking

Wallet/VPN/HR product impersonation.

T0184 · Credential Access · Harvesting sensitive information from files

Seeds, sessions, API keys, TOTP.

Sources

https://socket.dev/blog/malicious-chrome-extension-exfiltrates-seed-phrases
https://socket.dev/blog/malicious-chrome-extension-injects-hidden-sol-fees-into-solana-swaps
https://socket.dev/blog/malicious-chrome-extension-performs-hidden-affiliate-hijacking
https://socket.dev/blog/malicious-chrome-extension-steals-meta-business-manager-exports-and-totp-2fa-seeds
https://socket.dev/blog/malicious-chrome-extension-steals-mexc-api-keys
https://socket.dev/blog/malicious-chrome-extensions-phantom-shuttle
https://socket.dev/blog/5-malicious-chrome-extensions-enable-session-hijacking