A newly uncovered phishing campaign is targeting TRON wallet users through a deceptive Chrome extension that mimics the popular TronLink wallet.
The campaign highlights how modern browser extension abuse is evolving beyond static code inspection, making detection significantly harder.
At first glance, it appears legitimate, even displaying “1,000,000+ users” and strong ratings on the Chrome Web Store. However, these metrics are inherited from a previously legitimate extension listing that attackers likely hijacked and repurposed.
Detected by SlowMist’s MistEye monitoring system, the attack combines brand impersonation with dynamic remote content loading to silently harvest sensitive wallet credentials.
To strengthen the illusion, the attackers used Unicode bidirectional control characters and Cyrillic homoglyphs to spoof the TronLink brand name.
This trick makes the extension visually indistinguishable from the real wallet in the browser interface, effectively deceiving users during installation.
The extension requests minimal permissions, primarily storage access, while quietly declaring communication with external domains such as tronfind-api.tronfindexplorer.com.
This low-permission design helps it bypass security reviews that often flag overly broad access requests.
The attack operates in two layers. First, once installed, the extension loads a remote interface instead of relying on static local code. When a user clicks the extension icon, it checks connectivity to a remote server.
The malicious sample presents itself as a Chrome Manifest V3 (MV3) extension disguised as a blockchain explorer tool.
If available, it injects a full-screen iframe into the popup, loading attacker-controlled content in real time.
This design allows attackers to update the phishing interface dynamically without modifying the extension itself, effectively bypassing traditional static analysis.
Second, the remote page fully replicates the TronLink wallet interface using a Next js-based single-page application. Users interacting with the fake wallet are prompted to import credentials such as mnemonic phrases, private keys, or keystore files.
All entered wallet data is silently captured and sent to attacker-controlled infrastructure. The phishing page uses JavaScript functions like sendWords() to package sensitive information into JSON and transmit it via POST requests to backend APIs.
These credentials are then forwarded in real time to a Telegram bot using a specific chat ID.
Even newly generated wallets are compromised. The system logs generated mnemonic phrases and passwords through tracking functions, ensuring attackers gain full access regardless of how the wallet is created.
For example, if a user imports a wallet using a 12-word seed phrase, the data is immediately exfiltrated and delivered to the attacker’s Telegram channel within seconds.
The phishing site includes multiple defenses against detection and analysis. It disables right-click actions, blocks developer tools, clears console logs, and prevents text selection.
Additionally, it uses visitor tracking APIs to identify security researchers or sandbox environments, redirecting suspicious traffic to blank pages.
The campaign also employs geo-targeting. Users with Russian language settings or time zones are redirected to an alternative domain, trx-scan-explorer.org, suggesting tailored attack strategies or evasion of regional scrutiny.
The malicious infrastructure centers around tronfind-api.tronfindexplorer.com, which serves both as the extension’s remote UI endpoint and the backend for credential collection. The phishing site is hosted on Vercel, leveraging its global edge network for reliability and stealth.
MistEye flagged the campaign as high risk and issued alerts to users, emphasizing the growing threat of dynamic extension-based phishing attacks.
Since the malicious behavior depends on remotely loaded content, traditional extension reviews may fail to detect such threats.
Security experts recommend users avoid installing wallet extensions from unverified sources and carefully inspect extension updates, especially when trusted listings suddenly change branding or behavior.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…