Malicious Browser Extension
A browser add-on, often disguised as a useful tool, designed to intercept wallet activity, steal credentials, or silently modify transaction data in a victim's browser.
A malicious browser extension is a browser add-on, frequently disguised as a useful or innocuous tool, that's designed to monitor, intercept, or tamper with a victim's browsing activity specifically to compromise their crypto wallet — for example, by reading private keys or seed phrases entered into a web-based wallet, silently altering a transaction's destination address before the user signs it, or harvesting login credentials for exchange and wallet-related websites. Because extensions often request broad browser permissions to function, a malicious one can access a surprising amount of sensitive page content without the victim realizing it.
These extensions are commonly distributed through official browser extension stores by disguising their true purpose, mimicking a legitimate, popular tool's name and branding, or by being a genuinely useful extension that's later compromised or sold to a malicious actor who pushes an update containing hidden malicious code. Reviewing an extension's requested permissions, developer reputation, and recent update history, and minimizing the total number of installed extensions, are among the practical defenses against this risk.
Examples
- A malicious browser extension might silently swap a legitimate recipient address for an attacker's address right before a user confirms a wallet transaction in their browser.
- A previously trustworthy browser extension can later be compromised or sold to a malicious actor, who then pushes an update containing hidden malicious functionality to its existing user base.