Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data

A coordinated campaign involving malicious Chrome and Firefox extensions has been targeting cryptocurrency traders using Axiom Trade and Padre (now Terminal) platforms. The extensions, including J7Tracker, VREO, and Orbit Tracker, steal authenticated session tokens, wallet data, and browser state by injecting malicious JavaScript modules into active trading sessions. Data is exfiltrated via browser navigation to attacker-controlled domains hosted on Vercel and bonto.run infrastructure, bypassing CORS restrictions. The threat actor uses repackaged extensions with cloned functionality and maintains persistence through rotating C2 infrastructure and new publisher accounts, posing a direct risk of account compromise and cryptocurrency theft.

AI-extracted · verify before operational use