Poisoned Pipeline / Incidents / AS167

AS167 · 2026-03

Fake imToken Chrome extension seed-phrase theft

Browser extensions

Socket: fake imToken Chrome extension steals seed phrases via phishing redirects.

Mapped techniques

• T0136 Brandjacking
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/fake-imtoken-chrome-extension-steals-seed-phrases-via-phishing-redirects