Poisoned Pipeline

Poisoned Pipeline / Incidents / AS286

AS286 · 2026-09

J7Tracker / VREO / Orbit Tracker steal Axiom and Padre session and wallet data

Browser extensions

Socket (9 September 2026) documented six Chrome and Firefox extensions
in one publisher operation targeting Axiom Trade and Padre (now
Terminal) users. Chrome J7Tracker and VREO and Firefox VREO share a
byte-identical axiom-fetch-intercept.js module that pulls authenticated
user info, wallet bundle data, Firebase access tokens, and app state
to attacker Vercel deployments. Firefox Orbit Tracker arrived weeks
later with a separate collector and C2 (susi.bonto.run) but the same
Axiom fields (sBundles, bundleKey) and leftover J7Tracker popup
artifacts; it was still live at publication. Earlier Chrome GhostApe
and GhostApe Color in the same publisher portfolio were MockApe
brandjacks (even reusing the legitimate MockApe store ID). Chrome
listings were removed in July 2026 (J7Tracker/VREO as malware;
GhostApe pair as policy). Shared hardcoded id 7680513699 ties
J7Tracker/VREO.

Mapped techniques

supply-chain Marketplace extensions

T0109 · Resource Development · Publish malicious artifact

Chrome Web Store and Firefox Add-ons listings (J7Tracker, VREO, Orbit Tracker, GhostApe).

T0136 · Initial Access · Brandjacking

GhostApe cloned MockApe including the legitimate Chrome store ID; VREO/Orbit pose as trader tools.

T0184 · Credential Access · Harvesting sensitive information from files

Axiom/Padre session tokens, Firebase access tokens, wallet bundle keys, cookies.

Sources