PANews|Nov 14, 2025 04:08
[GoPlus: Beware of Malicious Chrome Extensions Disguised as ETH Wallets]
GoPlus has issued a security alert, warning users about a malicious Chrome extension disguised as an ETH wallet. This extension steals user assets by encoding their mnemonic phrases into Sui transactions. The malicious extension was released on November 12, 2024. It is advertised as a simple and secure Ethereum (ETH) wallet but contains a backdoor that encodes users' mnemonic phrases into Sui addresses and broadcasts micro-transactions from an attacker-controlled Sui wallet to steal the mnemonic phrases, exhibiting high levels of stealth. Currently, the malicious extension has not been removed from the Chrome Web Store. GoPlus has reported the issue to Chrome and blacklisted the download link.
Malicious extension name: Safery: Ethereum Wallet;
Attacker's email: kifagusertyna@gmail[.]com.
Share To
Timeline
HotFlash
APP
X
Telegram
CopyLink