Silent Swap steals crypto via fake Google Notes extension

Cybersecurity researchers have uncovered a sophisticated global malware campaign that steals cryptocurrency by secretly swapping wallet addresses during transactions. The campaign, which researchers have named "Silent Swap," uses a malicious browser extension disguised as a notetaking tool called "Google Notes" to target users of Chromium-based browsers like Google Chrome, Microsoft Edge, and Brave.

The malware is delivered through unsigned software installers, often disguised as free or cracked programs, that are written in .NET or Golang. Once executed, the installer forcibly terminates browser processes and modifies protected browser configuration files to install the fake extension. Crucially, the malware recalculates the security verification values browsers use to detect tampering, making the malicious extension appear legitimate and allowing it to load without user approval. On newer versions of Chrome and Edge, the attack still requires the browser's developer mode to be enabled, which attackers may attempt to achieve through social engineering.

Once installed, the extension requests broad permissions, including access to all visited websites, browsing history, and the...