Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses

Summary: McAfee Labs flagged an active campaign it codenamed Silent Swap, in which unsigned .NET and Golang installers deploy a malicious Chromium extension disguised as a 'Google Notes' utility that replaces wallet addresses copied to the clipboard. The extension requests clipboard, all-URL, and browsing-history permissions, and the malware rewrites browser Secure Preferences and Preferences files, recalculating hash/HMAC values so the extension loads silently without user approval.
What you should know: The clipper maps each victim's address to a unique attacker-controlled address server-side, and the one Solana address observed held $1,902.45 at the time of writing, with infections concentrated in India and also reported in the U.S., Brazil, Indonesia, and Spain. Because blockchain transactions are irreversible, a swapped address means permanent financial loss, and the EtherHiding technique lets the operator rotate command-and-control with a single smart contract transaction rather than redeploying malware.

Read the original at The Hacker News ↗