Malicious Chrome Extension ‘Crypto Copilot’ Caught Injecting Hidden Fees into Solana Swaps

• The Hack: A Chrome extension named “Crypto Copilot” secretly adds a fee transfer to user swaps.
• The Trick: It hides a SystemProgram.transfer instruction inside legitimate Raydium transactions.
• The Fix: Users must verify individual transaction instructions in their wallet preview before signing.

A malicious browser extension masquerading as a Solana trading tool has been caught siphoning funds from users by silently modifying transaction payloads.

Security researchers identified the harmful Chrome extension to secretly steal small amounts of SOL from Solana users during swaps. The extension, named Crypto Copilot, looks like a normal trading tool but quietly adds an extra transfer to every trade.

How the Fake Extension Works

Socket’s Threat Research Team found that Crypto Copilot has been available on the Chrome Web Store since June 2024. It advertises itself…

Read The Full Article Malicious Chrome Extension ‘Crypto Copilot’ Caught Injecting Hidden Fees into Solana Swaps On Coin Edition.