Six browser extensions steal trading session tokens
Socket found six malicious Chrome and Firefox extensions targeting Axiom Trade and Padre users, including J7Tracker and VREO, and tied them to a longer-running publisher operation that repackaged trading tools to look legitimate.
The extensions pull authenticated session data, wallet-related bundle data, Firebase access tokens, browser tokens, cookies, and application state from the active browser session, then send it to attacker-controlled infrastructure. In one case, the same collector code was byte-identical across Chrome and Firefox listings, which makes the theft work even when the add-on itself looks like a normal trading helper.
For teams that let users trade or connect wallets through browser add-ons, the exposure sits in the session, not just the install. Once those tokens leave the browser, removing the extension does not by itself undo the access it already captured.