Malicious Browser Extensions Target Crypto Traders

Malicious Browser Extensions Target Crypto Traders | 2026

Executive Summary

Socket Threat Research has disclosed a cross-browser extension operation targeting cryptocurrency traders through malicious Chrome and Firefox add-ons. The most important finding is simple: these extensions do not need to compromise the operating system first. They run inside the browser where victims are already authenticated to trading platforms, then collect session material, wallet-related application state, cookies, and tokens from Axiom Trade and Padre users.

The malicious cluster includes J7Tracker, VREO, and Orbit Tracker, with two earlier Chrome extensions, GhostApe and GhostApe Color, linked through publishing history and cloned marketplace artifacts. Socket said the Chrome listings were removed in July 2026, but Orbit Tracker remained live in Mozilla's add-ons ecosystem at publication time on September 9, 2026 and was reported to Mozilla.

For defenders, this is a browser-session theft story and a threat intelligence problem. The risk is not generic extension nuisanceware. It is targeted malware built to harvest authenticated crypto-trading data and exfiltrate it to actor-controlled infrastructure.

What happened?

Socket identified six Chrome and Firefox extensions tied together by shared code, command-and-control infrastructure, publisher history, cloned trading tools, marketplace artifacts, and targeting of Axiom Trade and Padre users.

• J7Tracker and VREO used the same malicious collection module across Chrome and Firefox builds.
• The shared module collected authenticated user information, Firebase access tokens, wallet-related bundle data, and browser application state.
• The stolen data was Base64-encoded and sent to threat actor-controlled Vercel deployments.
• Orbit Tracker appeared later in the Firefox ecosystem with separately implemented collection logic and different infrastructure, but targeted the same Axiom data model.
• GhostApe and GhostApe Color appear linked to the same Chrome publisher portfolio and show a broader pattern of repackaging crypto trading tools.

The campaign matters because it abuses a familiar trust path: users install a tool that appears relevant to their trading workflow, then the extension gains execution where sensitive authenticated state already exists.

Who is affected?

The most directly affected users are cryptocurrency traders who installed the malicious extensions and used Axiom Trade or Padre in the same browser profile.

Known malicious extensions

• J7Tracker - Chrome ID: ingjjklimdeocggninaaapofondbeopd
• VREO - Chrome ID: nngccnjcllkehfiaidagbffjgbikcoij
• VREO - Firefox ID: [email protected]
• Orbit Tracker - Firefox ID: [email protected]

Campaign-associated extensions

• GhostApe - Chrome ID: bnolicehjnimmdfkihmojhonickmhegp
• GhostApe Color - Theme Customizer - Chrome ID: kkkoejaiilcofkhggclkbogjpinhjppm

Enterprise exposure is most likely where employees use unmanaged browser profiles, install trading-related extensions on the same endpoint used for work, or maintain permissive browser-extension policies. Personal-wallet exposure can also create downstream corporate risk if the same browser profile stores SSO sessions, developer credentials, cloud-console access, or password manager sessions.

Initial access and collection path

The attack path is narrow but dangerous: the extension waits for the victim's browser context to contain useful trading data.

1. A user installs a malicious or repackaged crypto-themed extension.
2. The extension runs content scripts inside targeted browser sessions.
3. On Padre, the collector searches localStorage and IndexedDB for session and Firebase token material.
4. On Axiom Trade, it checks authentication state and uses the victim's existing session to query account and wallet APIs.
5. The extension collects values such as sBundles, bundleKey, authenticated user details, browser tokens, and cookies.
6. Stolen data is encoded and sent to attacker infrastructure through browser navigation or direct collection endpoints.
7. The attacker can use the exposed session and wallet-related data for account compromise, trading abuse, or cryptocurrency theft.

The clever part is the use of normal browser trust. Socket noted that the malware used navigation-based exfiltration in some cases, avoiding conventional cross-origin request patterns and making the true destination less obvious from a manifest-only review.

Indicators and detection

Browser inventory

Start with managed-browser extension inventory. Search for the extension IDs listed above across Chrome, Chromium-based browsers, and Firefox. Include historical inventory if current-state tooling only shows what remains installed today.

Network, DNS, and proxy telemetry

Hunt for connections to:

• dcfdc-eight[.]vercel[.]app
• snipex-iota[.]vercel[.]app
• susi[.]bonto[.]run
• cloudflare[.]bonto[.]run

Also search for requests containing:

• /api/collect?d=
• /api/code/
• /collect?d=

Preserve full URLs where available. Socket reported that exfiltrated data may be encoded directly into request paths or query parameters.

Identity and application telemetry

Review:

• unusual Axiom Trade or Padre session reuse
• login events shortly after extension installation or update
• unexpected wallet or trading activity
• token refreshes from unfamiliar locations or devices
• browser-cookie and session reuse patterns after suspected exposure

Example Splunk hunt

index=proxy OR index=dns
("dcfdc-eight.vercel.app" OR "snipex-iota.vercel.app" OR "susi.bonto.run" OR "cloudflare.bonto.run" OR "/api/collect?d=" OR "/api/code/" OR "/collect?d=")
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_user, src_ip, dest_host, uri, user_agent

Example browser-extension inventory hunt

index=edr OR index=browser_inventory
("ingjjklimdeocggninaaapofondbeopd" OR "nngccnjcllkehfiaidagbffjgbikcoij" OR "[email protected]" OR "[email protected]" OR "bnolicehjnimmdfkihmojhonickmhegp" OR "kkkoejaiilcofkhggclkbogjpinhjppm")
| stats values(extension_name) as names values(browser) as browsers min(_time) as firstSeen max(_time) as lastSeen by host, user, extension_id

Containment and remediation checklist

Immediate containment: 0-24 hours

• Block the confirmed malicious Chrome and Firefox extension IDs in managed environments.
• Remove the affected extensions from every browser profile where they appear.
• Revoke Axiom Trade and Padre sessions for exposed users.
• Rotate relevant authentication tokens and trading-platform credentials.
• Review wallet and trading activity for unauthorized actions.
• Preserve browser extension directories, browser profile data, proxy logs, and DNS telemetry for incident response.
• Block the known infrastructure at DNS, proxy, and secure web gateway layers.

Hardening: 24-72 hours

• Move high-value users to browser-extension allowlists.
• Separate cryptocurrency, financial, developer, and administrative sessions into hardened browser profiles.
• Monitor extension updates for publisher changes, new content scripts, host-permission expansion, and access to localStorage, IndexedDB, cookies, or authenticated application APIs.
• Add extension IDs and infrastructure into command-and-control and exfiltration detection pipelines.
• Review whether employees are using personal trading extensions on corporate endpoints.

Longer-term controls: 1-4 weeks

• Treat browser extensions as part of the software supply chain.
• Build a recurring review for browser extensions used with financial, crypto, developer, and privileged applications.
• Require justification for extensions with broad host permissions.
• Centralize browser telemetry where possible.
• Add suspicious extension behavior to user-awareness training, especially around crypto tools and cloned marketplace listings.

Strategic analysis

This campaign shows how browser extension abuse is becoming more application-specific. The extensions were not built only to scrape generic browsing data. They understood the storage and API patterns of particular trading platforms and reached for exactly the data that could matter most to attackers.

That shift changes the defender's job. A static list of "bad extensions" is useful, but it will always lag republishing, rebranding, and infrastructure rotation. The stronger detection opportunity is behavioral: an extension running inside authenticated financial or crypto sessions, reading browser storage and tokens, then sending encoded payloads to unexpected infrastructure.

The second lesson is about profile isolation. Many users keep personal finance, trading, developer, and work identity in the same browser. A malicious extension installed for one use case can observe data from another. For organizations, that makes browser extension governance part of credential and session-risk management, not just endpoint hygiene.

References

1. Socket - Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet Data