Threats · 49 days ago
Socket found six malicious Chrome and Firefox extensions targeting Axiom Trade and Padre users, including J7Tracker and VREO, and tied them to a longer-running publisher operation that repackaged trading tools to look legitimate.
The extensions pull authenticated session data, wallet-related bundle data, Firebase access tokens, browser tokens, cookies, and application state from the active browser session, then send it to attacker-controlled infrastructure. In one case, the same collector code was byte-identical across Chrome and Firefox listings, which makes the theft work even when the add-on itself looks like a normal trading helper.
For teams that let users trade or connect wallets through browser add-ons, the exposure sits in the session, not just the install. Once those tokens leave the browser, removing the extension does not by itself undo the access it already captured.
1 source covering this story
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.
Part of the PlainSec briefing for 2026-09-10