Poisoned Pipeline / Incidents / AS58
Chrome and Edge crypto-wallet drainer extensions
Browser extensionsCDN / web assets
Socket documented a campaign of Chrome Web Store and Microsoft Edge
Add-ons listings that impersonated crypto wallets, airdrop helpers, and
Web3 tools. Once installed they hooked page scripts, scraped seed
phrases and private keys, and drained connected wallets. Listings used
stolen or lookalike publisher names and review stuffing. This is the
browser-store analogue of typosquatting on npm.
Mapped techniques
- T0109 Publish malicious artifact
- T0110 Advertise malicious artifact
- T0136 Brandjacking
- T0154 Malicious IDE extension
- T0184 Harvesting sensitive information from files
supply-chain malicious browser extensions
Chrome Web Store and Edge Add-ons listings.
Wallet and airdrop impersonation in store search.
Lookalike wallet / Web3 product names.
Browser-extension analogue — runs in the victim browser with page access.
Seed phrases, private keys, and connected-wallet session data.